Skip to main content

Apple iOS/iPadOS CVE-2026-43722

| EUVDEUVD-2026-40190 MEDIUM
Improper Input Validation (CWE-20)
2026-06-29 apple GHSA-xf6q-rfcr-q877
Apple Information Disclosure Ios And Ipados
5.5
CVSS 3.1 · Vendor: apple
Share

Severity by source

Vendor (apple) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
5.5 MEDIUM

Local app vector with user-run requirement; no privileges needed but no integrity or availability impact, only kernel state read.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

5
Analysis Generated
Jun 30, 2026 - 16:31 vuln.today
CVSS changed
Jun 30, 2026 - 14:22 NVD
5.5 (MEDIUM)
Patch available
Jun 29, 2026 - 22:02 EUVD
CVE Published
Jun 29, 2026 - 19:42 cve.org
MEDIUM 5.5
CVE Published
Jun 29, 2026 - 19:42 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. An app may be able to leak sensitive kernel state.

AnalysisAI

Kernel state disclosure in Apple iOS, iPadOS, and macOS Tahoe allows a locally installed app to leak sensitive kernel memory through insufficiently sanitized input. All versions prior to iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2 are affected. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Attacker distributes malicious app
Delivery
User installs app on vulnerable device
Exploit
User launches app
Execution
App submits crafted input to kernel interface
Persist
Kernel returns sensitive state without sanitization
Impact
App reads kernel memory layout data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a malicious app to be installed and actively launched by the user on an affected Apple device running iOS/iPadOS or macOS prior to the 26.5.2 fixes - the UI:R component confirms this user-interaction prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 5.5 (Medium), reflecting a local attack with high confidentiality impact but no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker publishes a malicious app - distributed through a sideloading mechanism, enterprise provisioning profile, or a compromised App Store submission - that submits crafted input to a vulnerable kernel interface. When the user opens the app, it reads back sensitive kernel state data (such as kernel object addresses or layout information), which could be used as a building block in a multi-stage local privilege escalation chain targeting iOS or macOS. …
Remediation The primary fix is to update to iOS 26.5.2 and iPadOS 26.5.2 (via Settings > General > Software Update) and macOS Tahoe 26.5.2 (via System Settings > General > Software Update). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Ios And Ipados

View all
CVE-2026-39868 CRITICAL
9.1 Jun 29

Kernel memory corruption in Apple iOS/iPadOS (before 26.5.2) and macOS Tahoe (before 26.5.2) allows a malicious or compr
CVE-2026-43715 HIGH
8.8 Jun 29

Memory corruption in Apple's WebKit browser engine (Safari and the system WebView on iOS, iPadOS, and macOS before 26.5.
CVE-2026-43705 HIGH
8.8 Jun 29

Memory corruption via type confusion in Apple's WebKit browser engine allows attackers to corrupt memory by luring a vic
CVE-2026-43731 HIGH
8.8 Jun 29

Memory corruption via use-after-free in Apple's WebKit browser engine allows remote attackers to corrupt memory when a v
CVE-2026-28847 HIGH
8.8 May 11

Memory-corruption crash in Apple's WebKit web-content engine lets a malicious website terminate the content-rendering pr
CVE-2026-28955 HIGH
8.8 May 11

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and
CVE-2026-28947 HIGH
8.8 May 11

Use-after-free in WebKit allows remote attackers to trigger Safari crashes and potentially achieve arbitrary code execut
CVE-2026-43735 HIGH
8.1 Jun 29

The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS

CVE-2026-28907 HIGH
8.1 May 11

Content Security Policy bypass in Apple's WebKit-based platforms (iOS, iPadOS, macOS Tahoe, tvOS, visionOS, watchOS) all
CVE-2026-43724 HIGH
7.8 Jun 29

Local privilege escalation and kernel memory corruption in Apple iOS, iPadOS (before 26.5.2) and macOS Tahoe (before 26.
CVE-2026-28904 HIGH
7.5 May 11

Memory corruption in WebKit across Apple's ecosystem enables confidentiality breach via malicious web content without us
CVE-2026-28953 HIGH
7.5 May 11

Information disclosure in Apple WebKit's web content processing engine allows remote attackers to read sensitive memory

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2026-43722 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy