CVE-2026-43706: Apple Double Free Memory Vulnerability in iOS, macOS, iPadOS

Technical summary

CVE-2026-43706 is a double free vulnerability (CWE-415) in Apple's memory management subsystem. Double free occurs when a program attempts to release the same memory block twice, corrupting the heap and leading to denial of service. The vulnerability exists in web content processing code across multiple Apple platforms. While the immediate impact is process termination, double free conditions can occasionally be chained with heap spray techniques to achieve code execution—however, the published attack vector requires user interaction with malicious web content, and no evidence suggests reliable exploitation beyond crash has been demonstrated. CVSS 6.5 (Medium) reflects the attack complexity and requirement for user action.

Business impact

Organizations deploying Apple devices in production environments face service disruption if users are directed to malicious websites or receive crafted content via email or messaging. For knowledge workers relying on Safari or in-app browsers, unexpected crashes disrupt productivity. The lack of confidentiality or integrity impact limits the business severity, but availability loss affects user experience and support ticket volume. Organizations with stricter availability requirements should prioritize patching user-facing devices.

Affected systems

All recent Apple platforms are affected: iPhone OS (iOS 26.5.2 and later required), iPad OS (26.5.2 and later), macOS Sequoia (15.7.8 and later), macOS Sonoma (14.8.8 and later), macOS Tahoe (26.5.2 and later), tvOS (26.6 and later), visionOS (26.6 and later), and watchOS (26.6 and later). The vulnerability affects both consumer and enterprise deployments. Older OS versions remain vulnerable until updated.

Exploitability

The vulnerability is accessible remotely over the network (AV:N) without authentication (PR:N), but crucially requires user interaction—specifically, a user must visit a malicious website or open crafted content in a browser (UI:R). The attack complexity is low (AC:L), meaning no special conditions or tools are required once a user lands on a malicious page. Automated worm-style exploitation is not feasible. The flaw has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, and no in-the-wild exploits have been publicly documented as of the publication date.

Remediation

Apply the corresponding security update for your Apple device platform: iOS/iPadOS 26.5.2 or later, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, or watchOS 26.6. Updates are delivered via Apple's Software Update mechanism. Organizations should enable automatic updates or enforce patch deployment within 30 days, prioritizing devices used by staff who browse untrusted content or receive email from external sources.

Patch guidance

Enable automatic software updates on all Apple devices, or schedule updates during maintenance windows before users resume work. For iOS/iPadOS, navigate to Settings > General > Software Update and enable Automatic Updates. For macOS, use System Settings > General > Software Update. Enterprise administrators should use Mobile Device Management (MDM) solutions to enforce compliance and track patch deployment across fleets. Test updates on a representative device before broad rollout to ensure application compatibility.

Detection guidance

Monitor for unexpected crashes in Safari, WebKit-based applications, and in-app browsers—these are the primary attack surface. Kernel panic logs or application crash reports mentioning heap corruption or double free errors warrant investigation. Network-based detection is limited; focus on endpoint telemetry and user reports of browser crashes coinciding with visits to suspicious websites. Organizations using endpoint detection and response (EDR) tools should enable memory corruption detection rules if available. No public indicators of compromise (IOCs) have been published for this vulnerability.

Why prioritize this

Although CVSS 6.5 (Medium) suggests moderate risk, availability disruption on user-facing devices deserves timely remediation. The lack of KEV listing and absence of active exploitation reduce immediate urgency, but the low attack complexity and ease of delivery via web content make this a suitable target for threat actors seeking high-volume denial of service or user frustration campaigns. Prioritize patching mobile devices (iOS/iPadOS) and executive/remote worker laptops (macOS) within 30 days, then extend to all other platforms.

Risk score, explained

CVSS 6.5 (Medium) reflects: (1) network-accessible attack vector requiring no authentication, (2) low attack complexity with no special conditions, (3) mandatory user interaction reducing the attack surface, and (4) high impact on availability (crash) but no confidentiality or integrity loss. The score appropriately captures that while exploitation is feasible for any attacker with a web server, the damage is limited to denial of service and the barrier of user interaction prevents mass exploitation.

Frequently asked questions