CVE-2026-43723: Apple mediaremoted Flaw Lets Apps Gain Root Privileges, PoC Exploit Code Publicly Disclosed

TL;DR

Apple patched a flaw that let a local app gain root privileges through the mediaremoted service. Tracked as CVE-2026-43723, it carries a CVSS score of 7.8. Both the technical details and proof-of-concept exploit code are now public.

Why it matters

Root is the highest level of access on Apple systems. This Apple mediaremoted root privileges bug lets an unprivileged app cross that line. It affects a wide range of Apple platforms, so the reach is broad.

How the attack works

The root cause is a path handling issue. A crafted MediaRemote command supplies playback session data with a target filename. However, mediaremoted does not validate that filename properly.

That gap allows path traversal. The service then writes attacker-controlled data to any path with UID 0 rights. To succeed, the attacker must win a short race against a cleanup routine.

With an arbitrary file write as root, escalation follows. The researcher demonstrated it by dropping a sudo rule. This report withholds working payloads on purpose.

Public disclosure and exploit code

Full details and proof-of-concept code sit in a public CVE-2026-43723 repository. This public release raises the urgency for defenders to patch quickly.

Exploitation status

Public proof-of-concept exploit code exists for CVE-2026-43723. However, no in-the-wild exploitation has been confirmed at this time.

Affected versions

The flaw affects iOS, iPadOS, tvOS, visionOS, watchOS, and multiple macOS releases before the fixed builds.

Patch and mitigation

Update now. Apple fixed the issue in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. See Apple’s security update notes for the full list.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.