CVE-2026-43684

Use-After‑Free in Apple OS Allows Kernel Corruption and System Crash

View on CVE.org
Published Sep 14, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Golden Gate 27, macOS Sequoia 15.8. An app may be able to cause unexpected system termination or corrupt kernel memory.

Analysis

AI-generated

Technical impact

A use‑after‑free bug was found in Apple’s operating systems that allows an application to access freed memory. This flaw can lead to corruption of kernel memory, resulting in unexpected system termination or a compromise of kernel integrity. The vulnerability is a classic memory mismanagement issue that can subvert normal system execution flow.

Affected Systems

The vulnerability affects Apple iOS and iPadOS versions at or below 26.6, as well as macOS Golden Gate prior to version 27 and macOS Sequoia prior to 15.8. Users running any of these operating system releases remain at risk until they apply the latest update.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity of the vulnerability. The EPSS score is <1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because it can be triggered by a local application, the attack vector is inferred to be local or application‑based. Based on the description, it is inferred that the impact includes loss of availability due to potential system crashes.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest OS update—iOS 26.7 and iPadOS 26.7 for iOS devices, macOS Golden Gate 27 and macOS Sequoia 15.8 for Macs—so that the memory‑management fix is in place.
  • Force a reboot after the update to ensure that all system components use the corrected routines immediately.
  • Keep an eye on system logs for kernel panics or abnormal termination patterns and seek Apple support if such events recur.

Generated by OpenCVE AI on September 20, 2026 at 20:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Use-After‑Free in Apple OS Allows Kernel Corruption and System Crash
Type Values Removed Values Added
Title Use‑After‑Free in Apple macOS and iOS Leading to Kernel Memory Corruption
Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Use‑After‑Free in Apple macOS and iOS Leading to Kernel Memory Corruption
Weaknesses CWE-416
Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Type Values Removed Values Added
Description A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Golden Gate 27, macOS Sequoia 15.8. An app may be able to cause unexpected system termination or corrupt kernel memory.
References
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
apple
Published
Updated
Oct 26, 2026, 8:35 PM
Reserved
May 1, 2026, 10:46 PM

View source JSON

Updated
Sep 15, 2026, 6:20 PM

JSON

Status
Analyzed
Published
Sep 14, 2026, 9:17 PM
Modified
Sep 16, 2026, 4:18 AM

View source JSON

No data.

Updated
Sep 20, 2026, 9:00 PM

JSON