EUVD-2026-40203
GHSA-x77j-94p3-8rx3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or compromise an app
-
DeliveryRun app on unpatched device
-
ExploitSend malformed input to kernel interface
-
ExecutionTrigger improper input validation
-
PersistWrite kernel memory / crash system
-
ImpactEscalate privileges or deny service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the attacker to already be able to run code locally on the device as a normal app (CVSS PR:L, AV:L) - i.e., a malicious, compromised, or sandbox-escaping application installed on the iPhone, iPad, or Mac; it cannot be triggered remotely over the network. No user interaction is needed once the app runs (UI:N). The practical limiting factors are: the attacker must first achieve app-level code execution on the target, the target must be running an unpatched build below 26.5.2, and the affected platform must be iOS/iPadOS or macOS Tahoe. There is no special non-default configuration required beyond running the vulnerable OS version. |
| Impact | Signals are largely consistent and point to a serious-but-not-emergency local issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U) confirms exploitation requires local code execution with at least low privileges (i.e., a running app) and no user interaction, with high impact to confidentiality, integrity and availability - yielding 7.8 (High). EPSS is low (0.18%, 8th percentile) and CISA SSVC marks exploitation as 'none' and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation. However, SSVC flags it as automatable=yes with technical impact=total, meaning that IF a working exploit emerged it could be reliable and fully compromising. The 'Information Disclosure' tag is somewhat in tension with the description, which emphasizes kernel memory writes and system termination (integrity/availability) more than disclosure - treat the disclosure framing as secondary and verify against Apple's advisory. Net: prioritize patching as a standard high-severity OS update, but it does not warrant break-glass response absent local-code-execution risk in your environment. |
| Exploit ScenarioDerived | A user installs a malicious or trojanized app (or an attacker leverages an already-compromised app process); the app issues crafted, improperly-validated input to a vulnerable kernel interface, causing a write into kernel memory that either crashes the device (denial of service) or is shaped toward privilege escalation and full system compromise. No user interaction beyond running the app is required, but no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 30, 2026
Local privilege escalation and kernel memory corruption in Apple iOS, iPadOS (before 26.5.2) and macOS Tahoe (before 26.5.2) allows a malicious or compromised app to write kernel memory or force unexpected system termination by supplying improperly validated input to a privileged interface. Apple resolved the flaw through improved input sanitization. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and CISA SSVC records exploitation status as none, though it rates the technical impact as total and considers it automatable.
Earlier versions of this analysis (2)
Local privilege escalation and kernel memory corruption in Apple iOS/iPadOS before 26.5.2 and macOS Tahoe before 26.5.2 allows a malicious or compromised app to write kernel memory or force unexpected system termination via insufficient input sanitization (CWE-20). Apple addressed it with improved input validation. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), though the SSVC 'total' technical impact and 'automatable: yes' rating indicate serious potential consequences once a working primitive is developed.
Kernel memory corruption in Apple iOS/iPadOS and macOS Tahoe lets a locally installed app write to kernel memory or trigger unexpected system termination due to improper input validation. The flaw affects all versions before 26.5.2 across iPhone, iPad, and Mac, and was fixed by Apple with improved input sanitization. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS exploitation probability is low at 0.18% (8th percentile).
RemediationAI
Vendor-released patch: update to iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2, which fix the issue via improved input sanitization (see Apple advisories https://support.apple.com/en-us/127594 and https://support.apple.com/en-us/127595). Since exploitation requires a malicious or compromised local app, where immediate patching is not possible reduce risk by restricting app installation to vetted/MDM-managed sources, enforcing app sandboxing and not running untrusted applications, and using MDM to mandate the minimum OS build - the trade-off being administrative overhead and potential disruption to users who side-load or test internal apps. No reliable non-update workaround addresses the kernel flaw itself, so upgrading is the only definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-20 (Improper Input Validation): a kernel-level interface (reachable from a user-space application) failed to adequately sanitize attacker-controlled input before acting on it, permitting out-of-bounds or otherwise illegitimate writes into kernel memory. The CPE data scopes this to Apple's operating-system platforms - cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos - meaning the shared XNU kernel and its driver/IPC surface common to iPhone, iPad and Mac. Because the corruption occurs in kernel space, a successful write undermines the integrity of the most privileged execution context on the device, which is why Apple's remedy was hardening the input-validation/sanitization path rather than a logic change.
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires a local app with low privileges (AV:L, PR:L) and no user interaction; kernel memory write and system termination give total impact (C/I/A:H).
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
8DescriptionCVE.org
The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. An app may be able to cause unexpected system termination or write kernel memory.
Executive ViewAI
A local privilege escalation vulnerability (CVE-2026-43724) in Apple iOS, iPadOS, and macOS Tahoe allows malicious or compromised applications to gain kernel-level access and corrupt system memory. With a CVSS score of 7.8 and no public exploit identified at time of analysis, this represents a significant risk to organizations with Apple device deployments requiring prompt patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB