Description
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to leak sensitive kernel state.
Published: 2026-07-27
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability allows an application on macOS to read sensitive kernel state that should be protected, potentially leaking confidential information. The flaw originates from insufficient redaction of internal data, resulting in a direct information‑exposure weakness that undermines confidentiality of privileged data.

Affected Systems

Apple’s macOS operating system is affected. Earlier releases—including all versions before macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6—contain the flaw. Systems running those earlier releases remain vulnerable, and any local application that can execute with sufficient privileges may exploit the issue.

Risk and Exploitability

The vulnerability’s impact is moderate because exposure of kernel data can facilitate further attacks. The EPSS score is less than 1%, indicating a very low exploitation probability, but the lack of public exploits does not guarantee safety. The likely attack vector is a local application that obtains ordinary user‑level execution, from which it can introspect kernel memory. This combination of a data leak and a simple local execution path means the potential for exploitation remains possible.

Generated by OpenCVE AI on August 4, 2026 at 13:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade macOS to a version that contains the fix (Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6).
  • Limit the installation and execution of third‑party applications to trusted sources and monitor for anomalous kernel activity.
  • Apply system‑wide sandboxing or privilege reduction policies to prevent any running application from reading privileged kernel state.

Generated by OpenCVE AI on August 4, 2026 at 13:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Title Kernel State Information Exposure Vulnerability

Sat, 01 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Kernel State Information Exposure Vulnerability

Tue, 28 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Tue, 28 Jul 2026 02:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to leak sensitive kernel state.
References

cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-07-28T16:31:17.193Z

Reserved: 2026-05-01T22:46:27.815Z

Link: CVE-2026-43754

cve-icon Vulnrichment

Updated: 2026-07-28T16:12:53.596Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-27T21:16:59.957

Modified: 2026-07-29T17:04:01.270

Link: CVE-2026-43754

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T13:45:03Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor