CVE-2026-43777

CVE-2026-43777 presents a practical decision problem that Apple's advisory makes unnecessarily difficult. The CVE carries a 7.5 CVSS for denial-of-service, but EPSS sits at 0.00511 — meaning exploitation in the next 30 days is statistically unlikely. The standard guidance would be to deprioritize based on EPSS, but that framework breaks down here because Apple's disclosure tells you almost nothing about what you're actually protecting. The advisory states only that 'improved input validation' was applied and that a remote attacker could cause a denial of service. No component is named. No input vector is described. The phrase 'remote attacker' on macOS is itself informative — client operating systems have limited remote attack surfaces, which suggests this affects a network-facing component (Safari's rendering engine, a bundled server service, or possibly AirDrop). But you're guessing, and guessing is not risk assessment. Here's the decision framework that actually works: ignore the EPSS-CVSS tension for this class of vulnerability and evaluate blast radius instead. Ask whether this flaw lives in a highly interconnected component — shared rendering engines, system frameworks, authentication pipelines. If the DoS is in WebKit, it doesn't just crash Safari; it cascades into every app embedding WebKit content (Slack, Electron apps, third-party browsers). That cascade risk exists regardless of EPSS probability, and it's the reason to patch anyway. The version spread itself is informative. Separate fixes for Sequoia 15.7.8, Sonoma 14.8.8, and 'Tahoe' 26.6 indicate divergent code branches that required independent patching. That divergence represents architectural debt — it means the vulnerability likely existed across multiple code lineages for some time, unexercised. The low EPSS may reflect current attacker awareness (a lagged indicator), not true exploitability. For enterprises: patch now, but prioritize assets running the affected versions. The real operational risk isn't this specific CVE — it's the temporal exposure created by Apple's format. Each version represents a separate remediation timeline. Large organizations don't update all OS versions simultaneously; they tier deployment. That tiering is where exposure accumulates while teams parse version ambiguity. Your patching process is likely running three different timelines with different completion dates, and Apple's advisory makes that invisible to you. Audit which macOS versions are in your fleet, verify the three patched versions cover them, and accept that you cannot assess technical severity from this advisory — so weight blast radius and interconnectedness instead.

Reviewed through automated stages and approved by a human before publication.