CVE-2026-43783PoC(apple / macos)

MEDIUMCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch apple macos systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A malicious app may be able to gain root privileges.

apple CVEs Back to dashboard

4.3/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://support.apple.com/en-us/128067

Weakness type (CWE)

CWE-362

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

macos

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
13 mentions across 10 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 5 signals
PoC mentioned or linked in 8 signals
Patch or workaround mentioned in 8 signals
Technical details provided in 13 signals
Disclosure: 3 classified signals
Peaked 9d ago at 2 mentions (2026-09-15); latest day: 1
13 total mentions across 10 days

Affected systems

Vendors

apple

Products

macos

Deep dive

Activity timeline13 mentions / 10d

Signal classification4 categories

PoC

538.5%

Disclosure

323.1%

Exploit

323.1%

Patch

215.4%

Referenced assets20 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-15	2	Patch1PoC1
2026-09-16	1	Disclosure1
2026-09-18	1	Exploit1
2026-09-21	1	Exploit1
2026-09-22	1	PoC1
2026-09-24	2	PoC2
2026-09-26	1	Exploit1
2026-09-28	2	Disclosure2
2026-10-15	1	PoC1
2026-10-17	1	Patch1

Full discourse13 posts

PT SWARM@ptswarm45d
Patch
🍏 Fresh LPE in macOS: Repair Permissions - Get Root! CVE-2026-43783 found by our researcher Ilya Andr (@andrd3v) has been recently fixed by Apple. A single XPC request to DesktopServicesHelper lets you chown any path on disk - straight to root. 👇👇👇 https://ptswarm.com/blog/cve-2026-43783-repair-permissions-get-root-lpe-via-desktopserviceshelper-in-macos-26-5/ https://t.co/k77bElRYGM
Post summary
The post discloses a macOS local privilege escalation vulnerability fixed by Apple and briefly describes the root-level impact. Because the main remediation signal is that Apple has fixed the CVE, the primary classification is Patch.
52721486514.9K
18.8K followersView on X
Clandestine@akaclandestine32d
Disclosure
https://ptswarm.com/blog/cve-2026-43783-repair-permissions-get-root-lpe-via-desktopserviceshelper-in-macos-26-5/
Post summary
The referenced post discloses CVE‑2026‑43783, detailing a local privilege escalation in macOS 26.5 through repair permissions exploitation of DesktopServicesHelper.
02601058310.9K
64.9K followersView on X
Rıdvan Yağlı@ridvanyagli42d
Exploit
🔴 CVE-2026-43783 için Exploit/PoC yayınlandı: macOS'ta kötü amaçlı uygulamalar root yetkisine yükselebiliyor! LPE -> Root macOS 26.5.2 ve öncesini etkileyen DesktopServicesHelper kaynaklı LPE açığı, public PoC ile birlikte istismar edilebilir durumda. Bu açık, macOS 26.6 ile düzeltildi. PoC: https://github.com/andrd3v/CVE-2026-43783
Post summary
The tweet announces that an exploit/PoC for CVE-2026-43783 (an LPE flaw in macOS DesktopServicesHelper) has been published, provides a GitHub PoC link, and notes the issue was patched in macOS 26.6.
1270122587.7K
2.5K followersView on X
Ilya Andr@andrd3v45d
PoC
Missed one more from the drop lol CVE-2026-43783 - macOS LPE via DesktopServicesHelper. One XPC request -> arbitrary chown -> root. PT SWARM writeup: https://ptswarm.com/blog/cve-2026-43783-repair-permissions-get-root-lpe-via-desktopserviceshelper-in-macos-26-5/ My blog: https://andrd3v.github.io/cve-2026-43783/index.html PoC: https://github.com/andrd3v/CVE-2026-43783
Post summary
The post discloses CVE-2026-43783 as a macOS LPE issue and shares PT SWARM and personal writeups plus a GitHub PoC. It provides technical impact details but does not report active exploitation or remediation.
28051274.1K
181 followersView on X
ThreatWire@ThreatWire_13d
Patch
🍎 Apple patched 3 things worth your attention: 1️⃣ CVE-2026-86869: an iMessage image (EXR) could crash the decoder with no tap needed. The researcher confirmed the zero-click trigger on a real iPad. Full code execution was NOT shown. Fixed in iOS/iPadOS 26.7 and macOS Golden Gate 27. 2️⃣ CVE-2026-43783: a macOS flaw letting a local app reach root. Fixed in Tahoe 26.6. 3️⃣ iCloud Mail: spoofed @icloud.com senders could pass SPF, DKIM and DMARC. Fixed Dec 2025, no CVE. None is in CISA KEV. Update anyway. Full breakdown, sourced: https://www.threatwire.tech/research/apple-patches-exr-zero-click-bug-macos-root-flaw-and-icloud-mail-spoofing Which one worries you most? #Apple #iOS #macOS #InfoSec #CyberSecurity
Post summary
The text announces three Apple CVEs with technical details and explicitly names the fixed software versions for each, urging users to update despite none being in CISA KEV.
11037274.1K
1.9K followersView on X
dbugs@ptdbugs39d
Exploit
A PoC/exploit has been discovered for vulnerability CVE-2026-43783 PT ID: PT-2026-91498 Vendor: Apple Product: macOS Tahoe Description: A race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A malicious app may be able to gain root privileges. References: • https://dbu.gs/vulnerability/PT-2026-91498 • https://github.com/andrd3v/cve-2026-43783
Post summary
The text announces the discovery of a functional PoC/exploit for CVE-2026-43783, a race condition in macOS Tahoe allowing root privilege escalation, linking to a GitHub repository containing the code, while noting the vulnerability is patched in macOS Tahoe 26.6.
10017162.5K
3.7K followersView on X
Mr.Niko@_MrNiko38d
PoC
🚨 CVE-2026-43783 macOS DesktopServicesHelper sandboxed app. one XPC. chown any path. RepairPermissionsForCloudItems is on the sandbox allowlist. no path check. not limited to iCloud. helper is root, so fchown walks the tree and hands you the files. fixed by requiring http://com.apple.private.desktopservices.cloud-repair-perm. credit: Ilya Andr / @andrd3v https://ptswarm.com/blog/cve-2026-43783-repair-permissions-get-root-lpe-via-desktopserviceshelper-in-macos-26-5/ PoC: https://github.com/andrd3v/CVE-2026-43783 #macOS #ExploitDev #InfoSec
Post summary
The tweet discloses CVE-2026-43783, a macOS LPE vulnerability in DesktopServicesHelper, providing technical root cause details, a description of the fix, and a public PoC exploit on GitHub.
1002051.8K
1.6K followersView on X
Ryx@PadhiyarRushi34d
Exploit
One XPC to DesktopServicesHelper. "fchown" on any path. Root on macOS <26.6 CVE-2026-43783: "RepairPermissionsForCloudItems" in DesktopServicesHelper takes caller-supplied paths, "open(O_SYMLINK)" + "fchown" as root, no jail, no entitlement gate. Point it at "/private/etc/pam.d", own the PAM stack, get a passwordless root. PT SWARM writeup + working PoCs. Fixed in macOS 26.6. https://github.com/andrd3v/CVE-2026-43783 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #macOS #PrivilegeEscalation #LPE
Post summary
The tweet discloses a macOS Local Privilege Escalation (CVE-2026-43783) in DesktopServicesHelper, detailing the technical root cause and exploitation path to achieve root access, while explicitly releasing working PoCs via a linked GitHub repository and noting the fix in macOS 26.6.
300103631
954 followersView on X
dbugs@ptdbugs15d
PoC
Three Apple Ecosystem Vulnerabilities: Zero-Click Memory Corruption, iCloud Sender Spoofing, and Root Privilege Escalation Read on dbugs: https://dbu.gs/news/three-apple-ecosystem-vulnerabilities-zero-click-memory-corruption-icloud-sender-spoofing-and-root-privilege-escalation-20261015 • CVE-2026-86869: Zero-Click via iMessage and OpenEXR Researcher ironPeak discovered a heap buffer overflow in "libAppleEXR.dylib": the decoder allocates 12 bytes per RGB pixel but writes 16 bytes, including an additional constant alpha channel, while the RGB data is attacker-controlled. A crafted EXR attachment is automatically processed by ImageIO after an iMessage arrives, triggering memory corruption without user interaction and outside the BlastDoor sandbox. The researcher confirmed zero-click triggering on a real iPad and demonstrated an attacker-directed write and control of the program counter in a controlled test environment. Full remote code execution on a victim device was not demonstrated: the final exploitation step was blocked by Pointer Authentication (PAC), while hardware memory tagging provided additional protection in the affected background process on the newest Apple silicon. Apple fixed CVE-2026-86869 (https://dbu.gs/vulnerability/CVE-2026-86869) in September 2026 across iOS, iPadOS, and macOS 27. • Apple iCloud: Sender Spoofing While Passing SPF, DKIM, and DMARC Checks Timo Longin of SEC Consult discovered two SMTP parsing vulnerabilities that allowed an authenticated iCloud user to send emails appearing to originate from arbitrary "@icloud.com" addresses. The first technique exploited inconsistent handling of carriage-return ("CR") characters in the "From" header; the second used differences in dot-stuffing processing between Apple's SMTP parsers to manipulate how message headers and the body were interpreted. Because DKIM signatures were generated after the relevant message transformations, the spoofed emails passed SPF, DKIM, and DMARC checks, although the actual sender could still be identified in raw email headers such as "Return-Path" and "Authentication-Results". Apple confirmed that the issues had been remediated by December 2025, and SEC Consult published the technical analysis in October 2026. • CVE-2026-43783: Local Privilege Escalation to Root in macOS Researcher Ilya Andr of PT SWARM discovered CVE-2026-43783 (https://dbu.gs/vulnerability/CVE-2026-43783) in the privileged XPC service "DesktopServicesHelper": its "RepairPermissionsForCloudItems" handler failed to verify that supplied file paths belonged to iCloud. Through "fchown()", the service could change the ownership of an attacker-specified file or directory to the requesting user's UID. In the PoC, the attacker took ownership of "/private/etc/pam.d", created "sudo_local" containing "auth sufficient pam_permit.so", and bypassed "sudo" password authentication to obtain root privileges. The exploit used a sandboxed application with the "http://com.apple.security.app-sandbox" and "http://com.apple.security.temporary-exception.mach-lookup.global-name" entitlements to access the XPC service. Apple's patch introduced a mandatory check for the private entitlement "http://com.apple.private.desktopservices.cloud-repair-perm". Article (0-click): https://ironpeak.be/blog/ex-arrr-sailing-the-0-click-seas/ Article (iCloud spoofing): https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/ Article (root): https://ptswarm.com/blog/cve-2026-43783-repair-permissions-get-root-lpe-via-desktopserviceshelper-in-macos-26-5/ CVE-2026-43783 — PT-2026-91498: https://dbu.gs/vulnerability/PT-2026-91498 CVE-2026-86869 — PT-2026-91677: https://dbu.gs/vulnerability/PT-2026-91677
Post summary
A detailed article covering three Apple ecosystem vulnerabilities (CVE-2026-86869 zero-click iMessage/OpenEXR heap overflow, iCloud sender spoofing via SMTP parsing flaws, and CVE-2026-43783 macOS local privilege escalation) with PoC descriptions, technical analysis, and references to patches and researcher writeups.
12154712
3.7K followersView on X
Frank@jedisct132d
Disclosure
CVE-2026-43783: Repair Permissions – Get Root: LPE via DesktopServicesHelper in macOS 26.5 https://ptswarm.com/blog/cve-2026-43783-repair-permissions-get-root-lpe-via-desktopserviceshelper-in-macos-26-5/
Post summary
The tweet announces CVE-2026-43783, describing a local privilege escalation via DesktopServicesHelper in macOS 26.5 and linking to a detailed blog post, without mentioning patches, exploits, or active exploitation.
00074934
18.2K followersView on X
Daily CyberSecurity@Daily_CyberSec37d
PoC
Details and PoC for the critical macOS DesktopServicesHelper vulnerability are public. Learn how CVE-2026-43783 enables root access. #macOS #CVE202643783 #AppleSecurity #Cybersecurity #Infosec #PrivilegeEscalation https://securityonline.info/macos-desktopserviceshelper-vulnerability-poc/
Post summary
The post announces that a PoC for the critical macOS privilege escalation vulnerability CVE-2026-43783 is publicly available, linking to a detailed resource, but does not report active exploitation or mention a patch.
10030475
13.0K followersView on X
Ring3API 🇺🇦@ntlmrelay44d
Disclosure
Top 5 most shared links in my network (Sep 15): 1. https://www.sans.org/engage/dynamic-incident-response (12 people) 2. https://HackersDay.com (10 people) 3. https://ptswarm.com/blog/cve-2026-43783-repair-permissions-get-root-lpe-via-desktopserviceshelper-in-macos-26-5/ (9 people) 4. https://blog.trailofbits.com/2026/09/15/1passwords-ai-patching-benchmark-is-misleading/ (8 people) 5. https://github.com/dirkjanm/askWAM (8 people) #cybersecurity #blueteam
Post summary
The tweet shares cybersecurity links, one of which discloses CVE-2026-43783 as an LPE vulnerability in macOS 26.5 via DesktopServicesHelper. Technical vulnerability details are present, but no PoC, named exploit, active exploitation claim, or patch/workaround is mentioned in the tweet text itself.
00004279
6.7K followersView on X
NEXSIGHT@NEXSIGHTNEWS36d
PoC
macOSの権限修復機能にroot昇格の欠陥、実証コードが公開 — macOS 26.6で修正済み https://cyber.nexsight.co/articles/2026/09/24/macos-desktopserviceshelper-cve-2026-43783-lpe-poc-2026-09-24/
Post summary
A root escalation vulnerability in macOS DesktopServicesHelper has a published PoC, and Apple fixed it in macOS 26.6.
10020121
78 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	apple	macos	-	-	-

Explore more

Back to dashboard apple CVEs macos vulnerabilities

What researchers are saying

CVE-2026-43783

Clandestine[verified]@akaclandestineDisclosure

The referenced post discloses CVE‑2026‑43783, detailing a local privilege escalation in macOS 26.5 through repair permissions exploitation of DesktopServicesHelper.

Rıdvan Yağlı[verified]@ridvanyagliExploit

The tweet announces that an exploit/PoC for CVE-2026-43783 (an LPE flaw in macOS DesktopServicesHelper) has been published, provides a GitHub PoC link, and notes the issue was patched in macOS 26.6.

ThreatWire[verified]@ThreatWire_Patch

The text announces three Apple CVEs with technical details and explicitly names the fixed software versions for each, urging users to update despite none being in CISA KEV.

dbugs[verified]@ptdbugsExploit

The text announces the discovery of a functional PoC/exploit for CVE-2026-43783, a race condition in macOS Tahoe allowing root privilege escalation, linking to a GitHub repository containing the code, while noting the vulnerability is patched in macOS Tahoe 26.6.

Mr.Niko[verified]@_MrNikoPoC

The tweet discloses CVE-2026-43783, a macOS LPE vulnerability in DesktopServicesHelper, providing technical root cause details, a description of the fix, and a public PoC exploit on GitHub.

Ryx[verified]@PadhiyarRushiExploit

The tweet discloses a macOS Local Privilege Escalation (CVE-2026-43783) in DesktopServicesHelper, detailing the technical root cause and exploitation path to achieve root access, while explicitly releasing working PoCs via a linked GitHub repository and noting the fix in macOS 26.6.

dbugs[verified]@ptdbugsPoC

A detailed article covering three Apple ecosystem vulnerabilities (CVE-2026-86869 zero-click iMessage/OpenEXR heap overflow, iCloud sender spoofing via SMTP parsing flaws, and CVE-2026-43783 macOS local privilege escalation) with PoC descriptions, technical analysis, and references to patches and researcher writeups.

Frank[verified]@jedisct1Disclosure

The tweet announces CVE-2026-43783, describing a local privilege escalation via DesktopServicesHelper in macOS 26.5 and linking to a detailed blog post, without mentioning patches, exploits, or active exploitation.