CVE-2026-43722: Apple iOS, iPadOS, macOS Kernel Memory Leak Vulnerability

Technical summary

This CWE-20 input validation flaw permits local privilege escalation of information disclosure. An unprivileged application can craft malformed input that bypasses sanitization checks, allowing it to read kernel memory regions containing sensitive state. The vulnerability is triggered without user interaction and requires only local execution context—the attacker's app must be installed and running on the target system. The fix involves stricter input validation prior to kernel-level operations, preventing the bypass that allowed unauthorized memory reads.

Business impact

Organizations managing fleets of Apple devices face a confidentiality risk if employees unknowingly install a malicious app. An attacker gaining read access to kernel state could extract cryptographic keys, session tokens, or other secrets in memory, potentially enabling further compromise of corporate data or authentication systems. The impact is heightened in environments relying on iOS/iPadOS for sensitive work, though the requirement for app installation provides some natural friction. Enterprises should prioritize patching on devices handling financial or credential-based transactions.

Affected systems

The vulnerability affects three Apple product families: iOS (iPhone OS), iPadOS, and macOS. Fixed versions are iOS 26.5.2, iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.5.2. Any device running an earlier version of these operating systems remains vulnerable. This includes older iPhone and iPad models still receiving security updates, as well as Intel and Apple Silicon Mac systems across multiple major versions.

Exploitability

The barrier to exploitation is moderate. An attacker must first convince a user to install a malicious app—either through deceptive distribution, app store compromise, or social engineering. Once installed, the app can trigger the vulnerability without additional user interaction. There is no known public exploit, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation has not been detected in the wild at scale. However, the local-execution requirement and relatively straightforward nature of the flaw (input validation bypass) mean that capable threat actors could develop exploits independently.

Remediation

Apply the patched operating system versions immediately: iOS 26.5.2, iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.5.2. For enterprises, configure Mobile Device Management (MDM) policies to enforce automatic updates or restrict installation of apps from untrusted sources. Additionally, audit app permissions and remove or restrict applications that request unnecessary elevated access. Consider supplementary controls such as runtime monitoring for suspicious kernel access patterns, though operating system-level defenses should be the primary mitigation.

Patch guidance

Users should enable automatic software updates in Settings > General > Software Update on iOS/iPadOS, and in System Settings > General > Software Update on macOS. Enterprise administrators should deploy patches through their MDM solution, setting compliance policies to enforce device updates within 7–14 days depending on risk tolerance. Verify patch installation by confirming the build version matches the fixed release; for example, inspect iOS Settings > General > About. Prioritize patches on devices classified as high-risk (those accessing corporate networks, financial systems, or handling credentials).

Detection guidance

Monitor for suspicious app behavior using endpoint detection and response (EDR) tools on macOS. Look for unusual kernel memory access patterns, unexpected system calls, or attempts to read protected memory regions. On iOS/iPadOS, app-level detection is limited; rely instead on network-based signals (unexpected outbound connections from devices, unusual data exfiltration). Review MDM logs for devices that have not updated to patched versions within your compliance window. Conduct periodic app audits to identify and remove apps from untrusted publishers or those that have been flagged for suspicious behavior.

Why prioritize this

This vulnerability merits high-priority patching despite a CVSS score of 5.5 (medium) because it enables unauthorized access to kernel memory, which may contain cryptographic material and session state. The local-execution requirement and lack of current public exploitation reduce immediate urgency, but the confidentiality impact and the breadth of affected Apple products (three major families spanning multiple OS versions) justify treating it as a critical patch cycle item. Organizations should patch within 30 days; enterprises managing sensitive data should target 7–14 days.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a medium-severity vulnerability with low attack complexity and low privileges required—an unprivileged app can trigger the flaw without user interaction. However, the scope is unchanged (operating system only) and impact is limited to confidentiality; integrity and availability are not affected. This score appropriately captures the risk: meaningful but not emergency-level. Context matters: in zero-trust or high-security environments, elevate priority; in low-risk settings, follow standard patching cycles. The lack of KEV status and known active exploitation provide some breathing room for planning.

Frequently asked questions