CVE-2026-43783
macOS DesktopServicesHelper local privilege escalation to root
Apple fixed CVE-2026-43783 in macOS Tahoe 26.6 (27 July 2026). A malicious app may gain root through the DesktopServices component. Apple calls it a race condition. Researchers describe a missing path check in an XPC service. CVSS 7.8. Not in CISA KEV.
By ThreatWire Desk · Published 14 Sept 2026 · Updated 17 Oct 2026
- CVSS
- 7.8
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Class
- LPE
- Status
- PoC Available
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Apple
- Products
- macOS Tahoe
- Affected
- macOS Tahoe before 26.6. Apple's CVE record lists no other affected branches.
- Fixed
- macOS Tahoe 26.6, released 27 July 2026. Apple added this CVE to its 26.6 security notes on 14 September 2026.
- CWE
- Not recorded
- Published
- 14 Sept 2026
- Updated
- 17 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-43783 is a local privilege escalation in the DesktopServices component of macOS. Apple fixed it in macOS Tahoe 26.6, released 27 July 2026.
Apple added the CVE to its 26.6 security notes on 14 September 2026. NVD published it the same day.
Apple's impact line says a malicious app may be able to gain root privileges. Apple's description says a race condition was addressed with improved locking. The score is CVSS 3.1 7.8 (High), listed by NVD from a secondary source.
Researcher Ilya Andr of PT SWARM published a write-up on 15 September 2026. It describes a different cause. A helper service, DesktopServicesHelper, accepted file paths without checking they were iCloud paths. That let a sandboxed app change file ownership and reach root.
The two descriptions do not match word for word. Apple has not confirmed the researcher's explanation. The researcher says the fix adds a private entitlement check, com.apple.private.desktopservices.cloud-repair-perm.
Apple credits many finders for this CVE. Ilya Andr (andrd3v) is one of them. Others include Tommy DeVoss, Mahmoud Abdelmoniem, Kujtim Kryeziu and YingQi Shi.
A public PoC exists, according to the PT SWARM post. The write-up itself includes exploitation detail. ThreatWire has not run it. The PoC link field is left empty on purpose, and the write-up is a reference only.
The CVE is not in the CISA KEV catalog. CISA's SSVC entry says exploitation: none. No attacks are reported.
What to do: update to macOS Tahoe 26.6 or later. Treat any unknown app on a shared Mac with care until you do.