EUVD-2026-40203
GHSA-x77j-94p3-8rx3
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires a local app with low privileges (AV:L, PR:L) and no user interaction; kernel memory write and system termination give total impact (C/I/A:H).
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
10DescriptionCVE.org
The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. An app may be able to cause unexpected system termination or write kernel memory.
AnalysisAI
Local privilege escalation and kernel memory corruption in Apple iOS, iPadOS (before 26.5.2) and macOS Tahoe (before 26.5.2) allows a malicious or compromised app to write kernel memory or force unexpected system termination by supplying improperly validated input to a privileged interface. Apple resolved the flaw through improved input sanitization. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and CISA SSVC records exploitation status as none, though it rates the technical impact as total and considers it automatable.
Technical ContextAI
The vulnerability is rooted in CWE-20 (Improper Input Validation): a kernel-level interface (reachable from a user-space application) failed to adequately sanitize attacker-controlled input before acting on it, permitting out-of-bounds or otherwise illegitimate writes into kernel memory. The CPE data scopes this to Apple's operating-system platforms - cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos - meaning the shared XNU kernel and its driver/IPC surface common to iPhone, iPad and Mac. Because the corruption occurs in kernel space, a successful write undermines the integrity of the most privileged execution context on the device, which is why Apple's remedy was hardening the input-validation/sanitization path rather than a logic change.
RemediationAI
Vendor-released patch: update to iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2, which fix the issue via improved input sanitization (see Apple advisories https://support.apple.com/en-us/127594 and https://support.apple.com/en-us/127595). Since exploitation requires a malicious or compromised local app, where immediate patching is not possible reduce risk by restricting app installation to vetted/MDM-managed sources, enforcing app sandboxing and not running untrusted applications, and using MDM to mandate the minimum OS build - the trade-off being administrative overhead and potential disruption to users who side-load or test internal apps. No reliable non-update workaround addresses the kernel flaw itself, so upgrading is the only definitive fix.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today