What is the CVSS score of CVE-2026-39868?

CVE-2026-39868 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apple iOS are affected by CVE-2026-39868?

Apple iOS, iPadOS, and macOS Tahoe contain a critical kernel memory corruption vulnerability (CVE-2026-39868, CVSS 9.1) affecting all current-generation Apple devices.. A patch is available.

How to fix or mitigate CVE-2026-39868?

Within 24 hours: Identify all iOS, iPadOS, and macOS Tahoe devices in your managed device fleet. Within 7 days: Deploy iOS/iPadOS 26.5.2 and macOS Tahoe 26.5.2 to all managed devices; enforce automated security updates if available. Within 30 days: Audit third-party application permissions and security policies; review app deployment controls to reduce risk of compromised software installation.

Apple iOS CVE-2026-39868

EUVD-2026-40216 CRITICAL

Improper Input Validation (CWE-20)

2026-06-29 apple

GHSA-82rg-2v44-mpvr

Apple Information Disclosure Ios And Ipados

9.1

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

7.7 HIGH

Trigger is a locally installed app so AV:L not AV:N; no extra privileges or interaction needed (PR:N/UI:N); kernel memory corruption and panic give I:H/A:H with no disclosure (C:N).

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 13:23 vuln.today

CVSS changed

Jun 30, 2026 - 13:22 NVD

9.1 (CRITICAL)

Patch available

Jun 29, 2026 - 22:02 EUVD

CVE Published

Jun 29, 2026 - 19:43 cve.org

CRITICAL 9.1

CVE Published

Jun 29, 2026 - 19:43 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

This issue was addressed with improved input validation. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. An app may be able to cause unexpected system termination or corrupt kernel memory.

AnalysisAI

Kernel memory corruption in Apple iOS/iPadOS (before 26.5.2) and macOS Tahoe (before 26.5.2) allows a malicious or compromised app to corrupt kernel memory or trigger unexpected system termination via malformed input that bypasses validation. Reported by Apple internally and fixed with improved input validation; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Despite a high CVSS of 9.1, the practical attack surface is bound to code already executing on the device as an app.

Technical ContextAI

The flaw is a CWE-20 (Improper Input Validation) defect in the XNU kernel shared across iOS, iPadOS and macOS, reachable through a syscall, IOKit interface, or similar kernel entry point that an app-context process can invoke. Affected CPEs are cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos. Because the kernel accepts attacker-controlled data without sufficient validation, crafted parameters drive an out-of-bounds or otherwise inconsistent memory operation, producing kernel memory corruption (integrity loss) and/or a panic (availability loss). Apple's remediation note ('addressed with improved input validation') confirms the missing bounds/sanity checks as the root cause class.

RemediationAI

Apply the vendor-released patch: update to iOS 26.5.2 and iPadOS 26.5.2 on mobile devices and to macOS Tahoe 26.5.2 on Macs, per Apple advisories https://support.apple.com/en-us/127594 and https://support.apple.com/en-us/127595. Since the trigger is a locally running app, the most effective compensating control while patching is rolling out is to restrict app installation to trusted sources and MDM-approved catalogs and deny sideloading/enterprise-cert apps, which reduces the chance an untrusted app reaches the kernel interface but does not cover an already-trusted app that is later compromised. There is no documented feature-level toggle to disable the affected kernel path, so patching is the only complete fix; in the interim, prioritize devices that run third-party or recently installed apps and monitor for unexpected kernel panics as a weak detection signal.