This vulnerability (CVE-2026-43744) involves an out-of-bounds write triggered by processing an audio stream in a maliciously crafted media file on Apple iOS and iPadOS. The flaw could cause the targeted process to terminate unexpectedly, resulting in a denial of service condition. Apple fixed the issue by improving bounds checking in iOS 26.6 and iPadOS 26.6, as well as in other Apple OS versions. The CVSS 3.1 base score is 5.5 (medium severity), reflecting local attack vector, low complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality or integrity impact, and high impact on availability.

Successful exploitation results in denial of service by terminating the affected process handling the audio stream. There is no impact on confidentiality or integrity. The vulnerability requires local access and user interaction to trigger the crash via a crafted media file.

A fix is available and has been released by Apple in iOS 26.6 and iPadOS 26.6. Users and administrators should update affected devices to these versions or later to remediate this vulnerability. No additional mitigation is required as the issue is resolved in the official updates.