Apple macOS USD Library Vulnerability Allows Remote Code Execution
A heap-based buffer overflow in Apple's USD library, ZDI-26-494, enables remote attackers to execute arbitrary code on macOS systems.
Zero Day Initiative (ZDI) has disclosed a critical vulnerability, ZDI-26-494, affecting Apple's macOS operating system. The flaw resides within the Universal Scene Description (USD) library, a framework used for describing, composing, and interchanging 3D scene data. This vulnerability, identified as CVE-2026-43729, is a heap-based buffer overflow that can be triggered by remote attackers.
The vulnerability arises from the USD library's failure to properly validate the length of user-supplied data before copying it into a heap-based buffer. This oversight allows an attacker to provide oversized data, leading to a buffer overflow. Successful exploitation could enable an attacker to overwrite adjacent memory regions on the heap, potentially leading to the execution of arbitrary code within the context of the affected process.
While the vulnerability is classified as remote, exploitation requires user interaction. Attack vectors may vary depending on how the USD library is implemented and utilized within specific applications. However, the core mechanism involves tricking a user into interacting with a specially crafted USD file or data structure that triggers the overflow condition. The CVSS score for this vulnerability is rated at 7.8, indicating a high severity.
Apple has acknowledged the vulnerability and released security updates to address it. Users are strongly advised to update their macOS systems to the latest available version to mitigate the risk. The specific patch information can be found on Apple's support website, typically under security advisories or software update notes.
The disclosure timeline indicates that the vulnerability was initially reported to the vendor on April 9, 2026. Following a coordinated public release strategy, the advisory was made public on July 29, 2026, with an update to the advisory also occurring on the same day. This coordinated disclosure aims to provide users with sufficient time to apply patches before widespread exploitation becomes feasible.
This discovery was credited to Michael DePlante, who works with TrendAI Zero Day Initiative. The ZDI program is known for its rigorous research into software vulnerabilities and its practice of responsible disclosure, working with vendors to ensure security patches are available before publicizing findings.
The presence of such vulnerabilities in core system libraries like USD highlights the ongoing challenges in securing complex software ecosystems. Developers must maintain vigilance in input validation and memory management to prevent buffer overflows and other memory corruption issues that can lead to severe security consequences, including remote code execution.
Users of macOS should ensure their systems are up-to-date and remain cautious about opening files from untrusted sources, especially those that might interact with specialized libraries like USD, which are often used in graphics, animation, and other content creation workflows.
This advisory provides the CVE identifier CVE-2026-43733 for the vulnerability, which was reported by Michael DePlante of TrendAI Zero Day Initiative. The vulnerability has a CVSS score of 7.8 and was publicly disclosed on July 29, 2026, following coordinated disclosure with Apple.