ZDI-CAN-30380: ZDI-26-494: Apple macOS USD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Published Jul 29, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. Interaction with the USD library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-43729.

Affected Software

1 affected component

Apple macOS

Event History

Jul 29, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-30380?

The severity of ZDI-CAN-30380 is rated 7.8 according to the CVSS system.

How do I fix ZDI-CAN-30380?

To mitigate ZDI-CAN-30380, ensure that your Apple macOS is updated to the latest version that addresses the USD file parsing vulnerability.

What is the impact of ZDI-CAN-30380?

ZDI-CAN-30380 allows remote attackers to execute arbitrary code on affected installations of Apple macOS.

What conditions are required to exploit ZDI-CAN-30380?

Interaction with the USD library is required to exploit ZDI-CAN-30380, though attack vectors may vary.

Which software is affected by ZDI-CAN-30380?

ZDI-CAN-30380 affects installations of Apple macOS that utilize the USD library.