CVE-2026-43724: Apple iOS, macOS, iPadOS Kernel Memory Write Vulnerability – CVSS 7.8

Technical summary

CVE-2026-43724 is an input validation flaw (CWE-20) in Apple platforms that permits local privilege escalation and kernel memory corruption. The vulnerability exists in code paths that process untrusted input without adequate sanitization checks. An unprivileged application executing with standard user privileges can craft specific input sequences that bypass validation logic, resulting in out-of-bounds writes to kernel memory. The CVSS 3.1 score of 7.8 reflects local attack vector (AV:L), low complexity (AC:L), low privilege requirements (PR:L), no user interaction (UI:N), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H).

Business impact

Organizations deploying Apple devices in production environments face data confidentiality and system availability risks. A compromised device could allow attackers to read sensitive user data, modify system behavior, or cause denial of service. For enterprises managing fleets of company-issued iPhones, iPads, or Macs, this vulnerability elevates the importance of rapid patch deployment and app vetting procedures. The local-only nature means infection requires prior compromise or social engineering, but once achieved, the ability to write kernel memory fundamentally breaks the security model.

Affected systems

This vulnerability affects multiple Apple platforms: iOS and iPhone OS versions prior to 26.5.2, iPadOS versions prior to 26.5.2, macOS Sequoia (prior to 15.7.8), macOS Sonoma (prior to 14.8.8), macOS Tahoe (prior to 26.5.2), tvOS (prior to 26.6), visionOS (prior to 26.6), and watchOS (prior to 26.6). Organizations must verify exact device inventory and current OS versions to identify exposure.

Exploitability

While the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, the mechanics are concerning. Exploitation requires the attacker to first deliver and execute a malicious app on the target device—typically through social engineering, phishing, or compromise of a legitimate supply chain. However, once installed, the vulnerability requires neither elevated privileges at execution time nor user interaction, making it attractive as a post-compromise persistence or privilege escalation tool. Public exploit code has not been reported, but the 7.8 CVSS score and input validation nature suggest reproducibility.

Remediation

Apply the patched operating system versions immediately: iOS/iPadOS 26.5.2 or later, macOS Sequoia 15.7.8 or later, macOS Sonoma 14.8.8 or later, macOS Tahoe 26.5.2 or later, tvOS 26.6 or later, visionOS 26.6 or later, and watchOS 26.6 or later. Prioritize devices that run untrusted or user-installed applications. Review application install policies and consider restricting app store access to organization-approved software to reduce the attack surface for malicious apps.

Patch guidance

Apple has released security updates addressing this vulnerability through improved input sanitization logic across affected platforms. Patch deployment should follow a phased approach: first, production systems and high-value user accounts; second, developer and testing infrastructure; third, end-user devices. For macOS, leverage MDM (Mobile Device Management) tools to enforce automatic or scheduled updates. For iOS/iPadOS, ensure automatic update settings are enabled or deploy via MDM if available. Verify patch installation by checking Settings > General > About > OS Version on each device class. Test patches in a non-production environment first, particularly for mission-critical systems, to rule out compatibility issues.

Detection guidance

Monitor system logs for unexpected process termination, kernel panics, or restart events without user-initiated triggers. EDR (Endpoint Detection and Response) platforms should flag suspicious applications attempting to perform direct memory writes or system-level operations outside normal app sandbox constraints. Network-based indicators are limited since the attack is entirely local, but monitor for unusual application behavior preceding system crashes. Forensic analysis of core dumps or crash reports may reveal the memory corruption pattern. Consider endpoint telemetry that tracks which applications are loaded into memory and their system call patterns.

Why prioritize this

This vulnerability merits High priority due to kernel-level impact and the privileged nature of the attack surface. Although exploitation requires prior compromise, the ability to write kernel memory once installed represents a critical post-compromise capability. Organizations with strict app vetting and users unlikely to side-load applications face lower immediate risk; those with user-controlled app installation or BYOD policies face higher risk. The absence of known active exploitation reduces urgency slightly, but the 7.8 CVSS score and multi-platform reach justify rapid patching cycles.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects the combination of local-only attack vector, low complexity, low privilege requirement at execution time, and complete compromise of confidentiality, integrity, and availability. While the attack vector is limited to locally installed applications, the depth of impact—direct kernel memory corruption—justifies the upper-High band rather than Critical. The absence of network-based or unauthenticated attack paths keeps it from Critical severity.

Frequently asked questions