CVE-2026-43724 - Vulnerability Details

- Improper Input Sanitization Leading to Kernel Memory Write and System Termination in Apple OSes

Description

The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.

Published: 2026-06-29

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An application may trigger unexpected system termination or write kernel memory due to improper input sanitization. This flaw, classified as CWE‑20, threatens the integrity of the operating system and, based on the description, can lead to denial of service.

Affected Systems

Apple iOS and iPadOS versions prior to 18.7.10 and 26.5.2, macOS Sequoia earlier than 15.7.8, macOS Sonoma earlier than 14.8.8, macOS Tahoe earlier than 26.5.2, tvOS earlier than 26.6, visionOS earlier than 26.6, and watchOS earlier than 26.6 are vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates a high‑severity issue, though the EPSS score of <1% shows a low likelihood of exploitation. Attackers are expected to use a malicious or compromised application that supplies crafted input to trigger the kernel memory write. Until the updates are applied, the risk remains significant.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.7.10
`0`	affected	< 26.5.2

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 14.8.8
`0`	affected	< 15.7.8
`0`	affected	< 26.5.2

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 26.6

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 26.6

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 26.6

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::

No data.

Vendor Product Confidence Versions

Apple

Ios And Ipados

100%

Version	Status	Scheme	Platform
`[0,26.5.2)`	affected	generic	—

Apple

Macos

100%

Version	Status	Scheme	Platform
`[0,26.5.2)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade all affected Apple operating systems to the patched releases: iOS 18.7.10, iOS 26.5.2, iPadOS 18.7.10, iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6.
If any applications on tvOS, visionOS, or watchOS are known to trigger instability, temporarily uninstall or disable them until the OS update is applied.
Continuously monitor device logs for kernel panics or unexpected shutdowns, and report any anomalies to Apple for further investigation.

Generated by OpenCVE AI on August 17, 2026 at 23:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00325.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://support.apple.com/en-us/127594
https://support.apple.com/en-us/127595
https://support.apple.com/en-us/128068
https://support.apple.com/en-us/128069
https://support.apple.com/en-us/128070
https://support.apple.com/en-us/128071
https://support.apple.com/en-us/128072
https://support.apple.com/en-us/148287

History

Mon, 17 Aug 2026 23:45:00 +0000

Type	Values Removed	Values Added
Title		Improper Input Sanitization Leading to Kernel Memory Write and System Termination in Apple OSes

Mon, 17 Aug 2026 21:45:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.	The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.
References		https://support.apple.com/en-us/148287

Tue, 04 Aug 2026 08:45:00 +0000

Type	Values Removed	Values Added
Title	Kernel Memory Write via Improper Input Sanitization on Apple OS

Fri, 31 Jul 2026 17:15:00 +0000

Type	Values Removed	Values Added
Title		Kernel Memory Write via Improper Input Sanitization on Apple OS

Mon, 27 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. An app may be able to cause unexpected system termination or write kernel memory.	The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.
References		https://support.apple.com/en-us/128068 https://support.apple.com/en-us/128069 https://support.apple.com/en-us/128070 https://support.apple.com/en-us/128071 https://support.apple.com/en-us/128072

Tue, 30 Jun 2026 22:15:00 +0000

Type	Values Removed	Values Added
Title	Kernel Memory Write via Improper Input Sanitization on Apple Operating Systems

Tue, 30 Jun 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 30 Jun 2026 18:45:00 +0000

Type	Values Removed	Values Added
Title		Kernel Memory Write via Improper Input Sanitization on Apple Operating Systems

Tue, 30 Jun 2026 17:15:00 +0000

Type	Values Removed	Values Added
Title	Kernel Memory Write Vulnerability in Apple iOS/iPadOS/macOS via Improper Input Handling
Weaknesses	CWE-787

Tue, 30 Jun 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 30 Jun 2026 02:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos
Vendors & Products		Apple Apple ios And Ipados Apple macos

Mon, 29 Jun 2026 22:00:00 +0000

Type	Values Removed	Values Added
Title		Kernel Memory Write Vulnerability in Apple iOS/iPadOS/macOS via Improper Input Handling
Weaknesses		CWE-20 CWE-787

Mon, 29 Jun 2026 20:15:00 +0000

Type	Values Removed	Values Added
Description		The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. An app may be able to cause unexpected system termination or write kernel memory.
References		https://support.apple.com/en-us/127594 https://support.apple.com/en-us/127595

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2026-06-29T19:42:59.606Z

Updated: 2026-08-17T21:30:35.040Z

Reserved: 2026-05-01T22:46:21.645Z

Link: CVE-2026-43724

Vulnrichment

Updated: 2026-06-30T14:27:12.316Z

NVD

Status : Modified

Published: 2026-06-29T20:17:36.837

Modified: 2026-08-17T22:17:08.607

Link: CVE-2026-43724

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-17T23:30:04Z

Weaknesses

CWE-20
Improper Input Validation

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object