CVE-2026-43773 is a kernel-level out-of-bounds read vulnerability in macOS's disk image parsing subsystem, affecting Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. Apple's advisory describes it as 'improved bounds checking' — which translates to a missing or insufficient length validation in the DMG parsing code path that executes with ring-0 privileges. That's the critical detail: an untrusted disk image, parsed in kernel context, with no user-space intermediary.
An out-of-bounds read in this context is not a denial-of-service issue. It leaks kernel memory, which attackers use to defeat KASLR (kernel address space layout randomization). Once KASLR is broken, every other kernel vulnerability in the macOS attack surface becomes significantly more exploitable. The CVE's 'corrupt kernel memory' language likely understates the risk — an OOB read can trigger downstream state corruption, potentially converting an information leak into a write primitive. That changes the urgency profile substantially.
Three things should concern you: first, the patch landed across three divergent macOS branches simultaneously, suggesting the vulnerable code exists in branch-specific copies rather than a shared library — meaning the attack surface is more fragmented than a single CVE implies. Second, 'improved bounds checking' is a surgical fix at one call site; it does not indicate systemic input validation architecture for disk image parsing. Third, this fits a documented pattern — Apple has used identical remediation language for similar disk image parsing vulnerabilities over the past decade, which suggests the underlying architectural fix hasn't happened.
Your priorities: confirm your macOS version is among the patched builds, recognize that this vulnerability raises the exploitability of every other kernel bug in your environment, and treat the 'improved bounds checking' language as a signal that targeted patches rather than systematic hardening are the norm here. If you have visibility into your kernel extensions or third-party security tools, check whether they have visibility into disk image mounting operations — that telemetry gap is exactly where this class of vulnerability persists.