EUVD-2026-40190
GHSA-xf6q-rfcr-q877
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local app vector with user-run requirement; no privileges needed but no integrity or availability impact, only kernel state read.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. An app may be able to leak sensitive kernel state.
AnalysisAI
Kernel state disclosure in Apple iOS, iPadOS, and macOS Tahoe allows a locally installed app to leak sensitive kernel memory through insufficiently sanitized input. All versions prior to iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2 are affected. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.19% (9th percentile), indicating minimal current threat actor interest despite the kernel-level information exposure.
Technical ContextAI
The root cause is CWE-20 (Improper Input Validation): input passed from an app context to a kernel-level subsystem is not adequately sanitized, allowing the calling app to read back sensitive kernel state that should be inaccessible to unprivileged processes. Affected platforms per CPE are cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos, covering all versions of iOS/iPadOS and macOS prior to the 26.5.2/Tahoe 26.5.2 security update. In Apple's sandboxed app model, apps are supposed to be isolated from kernel internals - this flaw breaks that boundary at the information disclosure level without granting write or execution primitives directly. Kernel state leaks of this type are classically used as prerequisite steps to bypass ASLR or infer kernel object layouts in multi-stage local privilege escalation chains.
RemediationAI
The primary fix is to update to iOS 26.5.2 and iPadOS 26.5.2 (via Settings > General > Software Update) and macOS Tahoe 26.5.2 (via System Settings > General > Software Update). Patch availability is confirmed by Apple advisory at https://support.apple.com/en-us/127594 and https://support.apple.com/en-us/127595. No practical workaround exists that preserves full device functionality, since the vulnerable path is within the kernel input handling layer. As a compensating control in managed enterprise environments, Mobile Device Management (MDM) policies can be used to restrict installation of unvetted apps, reducing the attack surface by limiting the app vector required for exploitation - this trades app flexibility for reduced exposure while patch deployment is completed.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today