Apple Operating Systems CVE-2026-43654

Requires installation and execution of a malicious application on the target device. Despite CVSS vector indicating AV:N/PR:N (network, unauthenticated), the description explicitly states 'an app may be able to disclose kernel memory,' confirming that local app installation is the actual prerequisite-a fundamental contradiction with the assigned network attack vector. The application does not require special entitlements, root privileges, or user interaction beyond initial installation (PR:N/UI:N once app context is achieved). No specific system configuration, non-default settings, or feature enablement is mentioned as required. Exploitation is limited by Apple's app installation mechanisms: on iOS/iPadOS, requires either App Store approval (bypassed through review evasion), enterprise certificates, or device jailbreaking; on macOS, Gatekeeper and notarization provide weaker barriers. The information disclosure is bounded by kernel memory layout randomization and the app's ability to target specific memory regions, though repeated exploitation could overcome ASLR. Platform-specific limitations: watchOS and tvOS have more restricted app ecosystems, reducing practical attack surface despite technical vulnerability.

The CVSS score of 7.5 with vector AV:N/AC:L/PR:N/UI:N suggests high severity through remote unauthenticated exploitation with low complexity. However, multiple signals indicate substantially lower real-world risk than the raw score implies. The EPSS probability of 0.02% (7th percentile) reflects minimal observed exploitation interest despite apparent ease of exploitation. Critical contradictions exist in the data: the CVSS vector specifies network attack vector (AV:N) requiring no privileges (PR:N), yet the description states 'an app may be able to disclose kernel memory,' implying local app installation is the actual prerequisite-a fundamental inconsistency suggesting the CVSS vector may not accurately reflect the true attack scenario. If app installation is required, the realistic attack vector is local (AV:L), not network, dramatically reducing practical risk. The vulnerability provides only confidentiality impact (C:H/I:N/A:N)-information disclosure without system compromise. SSVC factors: exploitation status is public (vulnerability disclosed), automatable is yes (if truly network-based), technical impact is partial (data exposure only). Primary concern is targeted attacks against high-value devices where kernel memory could contain encryption keys or authentication tokens. The absence of KEV listing and extremely low EPSS despite public disclosure for several weeks strongly suggests this is either difficult to exploit in practice or limited by undisclosed prerequisites, making it lower priority than the CVSS score alone indicates.

An attacker develops a malicious application and distributes it through app stores or side-loading mechanisms. Once installed on a vulnerable Apple device, the app exploits the memory handling flaw to read arbitrary kernel memory without requiring elevated privileges. The attacker extracts sensitive information such as encryption keys, authentication tokens, or memory addresses from other processes, which could enable further attacks like bypassing security mitigations or decrypting user data. No public exploit code identified at time of analysis.