← Advisories
CVE-2026-43785
File Bookmark permissions issue allows writing to a read-only file
- Vendor
- Apple
- Component
- File Bookmark
- Severity
- 5.5 Medium
- Status
- Fixed
Apple’s advisory
Apple published this issue on 14 September 2026 under the File Bookmark component.
Impact. An app may be able to modify a file it only had permission to read.
Description. A permissions issue was addressed with additional restrictions.
Fixed in
- iOS 27 and iPadOS 27
- macOS Golden Gate 27
- macOS Tahoe 26.7
- macOS Sequoia 15.8
- tvOS 27
- visionOS 27
Credit
Apple credits Junyeong Lee (jylab.github.io), Merrick Hare, Narendra Singh (@_3P1C), John Nzyuko Uvyu, and Aditya Kumar.
References
- NVD — CVE-2026-43785 (CVSS 3.1 5.5 Medium,
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) - Apple — About the security content of iOS 27 and iPadOS 27
- Apple — About the security content of macOS Tahoe 26.7
- Apple — About the security content of macOS Golden Gate 27
- Apple — About the security content of macOS Sequoia 15.8
- Apple — About the security content of tvOS 27
- Apple — About the security content of visionOS 27
This page reproduces Apple’s published advisory. The technical write-up is published separately at merrickhare.com. No proof-of-concept code is published for this issue.