ZDI-26-493: Apple macOS USD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Published Jul 29, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. Interaction with the USD library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-43733.

Affected Software

1 affected component

Apple macOS

Event History

Jul 29, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-26-493?

ZDI-26-493 has a CVSS rating of 7.8, indicating it is a high severity vulnerability.

How do I fix ZDI-26-493?

To fix ZDI-26-493, ensure you update your Apple macOS to the latest version which addresses this vulnerability.

What type of vulnerability is ZDI-26-493?

ZDI-26-493 is a heap-based buffer overflow vulnerability that allows remote code execution.

Who can exploit ZDI-26-493?

Remote attackers with access to the USD library may exploit ZDI-26-493 to execute arbitrary code.

What systems are affected by ZDI-26-493?

ZDI-26-493 affects installations of Apple macOS that interact with the USD library.