EUVD-2026-40216
GHSA-82rg-2v44-mpvr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or compromise app on device
-
ExploitInvoke vulnerable kernel interface with malformed input
-
ExecutionCorrupt kernel memory / trigger panic
-
ImpactSystem termination or privilege escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the attacker to already be running code in an app context on the target device (the description states 'An app may be able to cause unexpected system termination or corrupt kernel memory') - i.e., a malicious or compromised application must be installed and executing. The limiting factors are: the device must be on iOS/iPadOS or macOS Tahoe earlier than 26.5.2, and the attacker must achieve app execution first (via App Store abuse, sideloading, enterprise provisioning, or compromising a legitimate app); no additional user interaction or elevated privileges within the app are indicated. Note the supplied CVSS AV:N contradicts this local-app prerequisite and should be verified with the vendor before treating the bug as remotely reachable. |
| Impact | The signals conflict and must be reconciled. The supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N, I:H/A:H, score 9.1) implies remote, unauthenticated, network-reachable exploitation, but the Apple description explicitly states 'An app may be able to...', which is a local, app-context primitive - verify with vendor, as the network vector appears overstated for a kernel-memory bug triggered by an installed app. No EPSS score was provided, KEV status is not set (treat as not actively exploited), and no POC is referenced, so there is no public exploit identified at time of analysis. Realistic priority is moderate-to-high for managed fleets: it is a strong privilege-escalation / sandbox-escape building block (kernel memory corruption) but requires the attacker to first get code running as an app, which is a meaningful gate. Patch availability and Apple's own reporting raise confidence the fix is real; the absence of exploitation evidence argues against emergency out-of-band action beyond normal expedited patching. |
| Exploit ScenarioDerived | An attacker convinces a user to install a seemingly benign app (or compromises an existing one) that invokes the vulnerable kernel interface with malformed input, corrupting kernel memory to crash the device or, with further effort, to escalate privileges and escape the app sandbox. No public POC is referenced, and the low attack complexity means a working trigger, once developed, would reliably reproduce on unpatched 26.5.x devices. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 30, 2026
Kernel memory corruption in Apple iOS/iPadOS (before 26.5.2) and macOS Tahoe (before 26.5.2) allows a malicious or compromised app to corrupt kernel memory or trigger unexpected system termination via malformed input that bypasses validation. Reported by Apple internally and fixed with improved input validation; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Despite a high CVSS of 9.1, the practical attack surface is bound to code already executing on the device as an app.
RemediationAI
Apply the vendor-released patch: update to iOS 26.5.2 and iPadOS 26.5.2 on mobile devices and to macOS Tahoe 26.5.2 on Macs, per Apple advisories https://support.apple.com/en-us/127594 and https://support.apple.com/en-us/127595. Since the trigger is a locally running app, the most effective compensating control while patching is rolling out is to restrict app installation to trusted sources and MDM-approved catalogs and deny sideloading/enterprise-cert apps, which reduces the chance an untrusted app reaches the kernel interface but does not cover an already-trusted app that is later compromised. There is no documented feature-level toggle to disable the affected kernel path, so patching is the only complete fix; in the interim, prioritize devices that run third-party or recently installed apps and monitor for unexpected kernel panics as a weak detection signal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-20 (Improper Input Validation) defect in the XNU kernel shared across iOS, iPadOS and macOS, reachable through a syscall, IOKit interface, or similar kernel entry point that an app-context process can invoke. Affected CPEs are cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos. Because the kernel accepts attacker-controlled data without sufficient validation, crafted parameters drive an out-of-bounds or otherwise inconsistent memory operation, producing kernel memory corruption (integrity loss) and/or a panic (availability loss). Apple's remediation note ('addressed with improved input validation') confirms the missing bounds/sanity checks as the root cause class.
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Trigger is a locally installed app so AV:L not AV:N; no extra privileges or interaction needed (PR:N/UI:N); kernel memory corruption and panic give I:H/A:H with no disclosure (C:N).
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
This issue was addressed with improved input validation. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
Executive ViewAI
Apple iOS, iPadOS, and macOS Tahoe contain a critical kernel memory corruption vulnerability (CVE-2026-39868, CVSS 9.1) affecting all current-generation Apple devices. An installed application-whether malicious or compromised through supply chain-can corrupt kernel memory and crash devices, impacting device availability and data integrity. With a vendor patch immediately available, this presents significant risk to organizations with unpatched Apple device fleets, particularly those with app-heavy environments.
Apply vendor patch. Until patched, restrict unprivileged user ability to sideload apps or install untrusted applications; enforce application allowlisting on high-risk devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB