CVE-2026-43684: Apple iPadOS Use-After-Free Vulnerability

CVE-2026-43684 Overview

CVE-2026-43684 is a use-after-free vulnerability [CWE-416] affecting Apple iOS, iPadOS, and macOS. A local application can trigger unexpected system termination or corrupt kernel memory by exploiting improper memory management. Apple addressed the issue with improved memory management in iOS 26.7, iPadOS 26.7, macOS Golden Gate 27, and macOS Sequoia 15.8.

The flaw requires local access and low privileges but no user interaction. Successful exploitation impacts confidentiality, integrity, and availability of the affected system. While no in-the-wild exploitation has been confirmed, use-after-free conditions in Apple kernel components have historically served as building blocks in privilege escalation chains.

Critical Impact
A local app can corrupt kernel memory, potentially leading to system crashes or kernel-level compromise on affected Apple devices.

Affected Products

Apple iOS versions prior to 26.7
Apple iPadOS versions prior to 26.7
Apple macOS versions prior to Golden Gate 27 and Sequoia 15.8

Discovery Timeline

2026-09-14 - CVE-2026-43684 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-43684

Vulnerability Analysis

CVE-2026-43684 is a use-after-free condition in an Apple operating system component shared across iOS, iPadOS, and macOS. Apple's advisory states that an app may be able to cause unexpected system termination or corrupt kernel memory, indicating the vulnerable code path executes within kernel context.

Use-after-free flaws occur when code continues to reference memory that has already been freed. Attackers who influence the timing of allocation and deallocation can reclaim the freed region with controlled data. When the stale pointer is later dereferenced, the attacker-controlled contents drive kernel execution paths.

On Apple platforms, kernel memory corruption typically serves as a stepping stone toward sandbox escape or full kernel read/write primitives. The flaw affects both mobile and desktop products, meaning exploitation techniques may translate across iOS and macOS with limited modification.

Root Cause

The root cause is improper lifecycle management of a kernel object. The vulnerable code releases an object while retaining or exposing a reference that remains reachable. Apple's fix description confirms remediation through improved memory management, consistent with tightening reference counting, ownership tracking, or lock scope around the affected object.

Attack Vector

Exploitation requires local code execution on the target device. An attacker must deliver and run a malicious application with low privileges. No user interaction beyond launching the app is required. Because the vulnerability sits in shared operating system code, a single exploit primitive can target multiple Apple product families.

Apple has not published a technical exploitation write-up. Refer to the vendor advisories for affected component identification: Apple Support Article #149035, Apple Support Article #149041, and Apple Support Article #149043.

Detection Methods for CVE-2026-43684

Indicators of Compromise

Unexpected kernel panics or system reboots on devices running vulnerable iOS, iPadOS, or macOS versions
Crash reports referencing memory access violations in kernel extensions or IOKit components
Installation of unsigned or sideloaded applications on managed Apple devices immediately preceding a panic event

Detection Strategies

Collect and centrally analyze macOS ips panic logs from /Library/Logs/DiagnosticReports/ for repeated kernel faults on the same system
On managed iOS and iPadOS fleets, use Mobile Device Management (MDM) telemetry to flag devices reporting elevated crash rates after new app installation
Correlate application launch events with subsequent kernel panics to identify candidate exploitation attempts

Monitoring Recommendations

Track OS build versions across the fleet and prioritize devices still running versions below iOS 26.7, iPadOS 26.7, macOS Sequoia 15.8, or macOS Golden Gate 27
Enable macOS unified logging retention and forward panic diagnostics to a centralized log store for retrospective analysis
Monitor App Store and enterprise distribution channels for newly installed applications requesting unusual entitlements

How to Mitigate CVE-2026-43684

Immediate Actions Required

Update all Apple devices to iOS 26.7, iPadOS 26.7, macOS Sequoia 15.8, or macOS Golden Gate 27
Enforce update deployment through MDM policies with a defined compliance deadline
Restrict installation of untrusted third-party applications, including sideloaded and TestFlight builds, on managed devices
Audit installed applications on high-value endpoints and remove any unsigned or unknown binaries

Patch Information

Apple released fixes across three advisories. Review Apple Support Article #149035, Apple Support Article #149041, and Apple Support Article #149043 to map the patch to specific device models. Apply the updates through Software Update on macOS and General → Software Update on iOS and iPadOS.

Workarounds

No vendor-supplied workaround exists; patching is the only supported remediation
Limit local code execution risk by restricting app installation sources to the App Store and vetted enterprise distributions
Apply Lockdown Mode on high-risk iOS, iPadOS, and macOS devices to reduce attack surface until patches are deployed

bash

# Verify current OS build on macOS
sw_vers

# Trigger a software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart