CVE-2026-84530

Kernel Memory Information Disclosure via Improper Memory Management on Apple Operating Systems

Published Sep 14, 2026 CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Description

An information disclosure issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to disclose kernel memory.

Analysis

Technical impact

The CVE describes a flaw in memory‑management handling on Apple operating systems that allows an application to read from kernel memory. This vulnerability enables the disclosure of kernel memory, which results in an information disclosure of sensitive internal system data.

Affected Systems

Exact affected versions are not listed in the CVE, but the flaw exists in releases prior to the updates described in the fix: iOS 26.7, iPadOS 26.7, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. Devices running any of the affected operating systems before those versions are considered vulnerable.

Risk and Exploitability

The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalogue, indicating a very low likelihood of exploitation. The CVSS score is 3.3, indicating a low but non‑negligible severity. The vulnerability allows an application to read kernel memory, which can expose internal system data. The attack vector is local via an application, as the issue requires an app to read kernel memory. No remote exploitation is documented.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 26.7
`0`	affected	< 27

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 26.7
`0`	affected	< 27

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 27

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 27

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 27

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

Vendor Product Versions

Apple

Ios And Ipados

Version	Status	Scheme	Platform
`[0,26.7)`	affected	generic	—
`[0,27)`	affected	generic	—

Apple

Macos

Version	Status	Scheme	Platform
`[0,26.7)`	affected	generic	—
`[0,27)`	affected	generic	—

Apple

Tvos

Version	Status	Scheme	Platform
`[0,27)`	affected	generic	—

Apple

Visionos

Version	Status	Scheme	Platform
`[0,27)`	affected	generic	—

Apple

Watchos

Version	Status	Scheme	Platform
`[0,27)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the operating system to the latest firmware that contains the memory‑management fix (iOS 26.7 or newer, iPadOS 26.7 or newer, macOS Golden Gate 27 or newer, macOS Tahoe 26.7 or newer, tvOS 27 or newer, visionOS 27 or newer, or watchOS 27 or newer).
Install applications only from the official App Store or approved enterprise catalogs to reduce the likelihood that a malicious app could exploit this flaw.
Monitor the device for anomalous application behavior and enforce strict sandboxing to prevent privileged operations that could access kernel memory.

Generated by OpenCVE AI on September 20, 2026 at 19:59 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.148% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://support.apple.com/en-us/149034
https://support.apple.com/en-us/149035
https://support.apple.com/en-us/149036
https://support.apple.com/en-us/149037
https://support.apple.com/en-us/149038
https://support.apple.com/en-us/149041
https://support.apple.com/en-us/149042

History

Sep 20, 2026 8:15 PM Title updated View changes

Type	Values Removed	Values Added
Title		Kernel Memory Information Disclosure via Improper Memory Management on Apple Operating Systems

Sep 18, 2026 9:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple ipados Apple iphone Os
CPEs		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:tvos:::::::: cpe:2.3:o:apple:visionos:::::::: cpe:2.3:o:apple:watchos::::::::
Vendors & Products		Apple ipados Apple iphone Os

Sep 17, 2026 5:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-200
Metrics		cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 16, 2026 11:15 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Information Disclosure via Kernel Memory Access in Apple Operating Systems
Weaknesses	CWE-200

Sep 15, 2026 11:30 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Information Disclosure via Kernel Memory Access in Apple Operating Systems
Weaknesses		CWE-200

Sep 15, 2026 2:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos Apple tvos Apple visionos Apple watchos
Vendors & Products		Apple Apple ios And Ipados Apple macos Apple tvos Apple visionos Apple watchos

Sep 14, 2026 9:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		An information disclosure issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to disclose kernel memory.
References		https://support.apple.com/en-us/149034 https://support.apple.com/en-us/149035 https://support.apple.com/en-us/149036 https://support.apple.com/en-us/149037 https://support.apple.com/en-us/149038 https://support.apple.com/en-us/149041 https://support.apple.com/en-us/149042