CVE-2026-43722: Apple iPadOS Information Disclosure Flaw

CVE-2026-43722 Overview

CVE-2026-43722 is an input validation vulnerability [CWE-20] affecting Apple iOS, iPadOS, and macOS. A local application can exploit improper input sanitization to leak sensitive kernel state. Apple addressed the issue with improved input sanitization in iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2.

The flaw requires local access with low privileges and no user interaction. Successful exploitation exposes kernel memory contents that attackers can use to bypass Kernel Address Space Layout Randomization (KASLR) or chain into further exploitation.

Critical Impact
A malicious app installed on an Apple device can read sensitive kernel state, undermining kernel address randomization and enabling reliable follow-on exploitation.

Affected Products

Apple iOS versions prior to 26.5.2
Apple iPadOS versions prior to 26.5.2
Apple macOS Tahoe versions prior to 26.5.2

Discovery Timeline

2026-06-29 - CVE-2026-43722 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-43722

Vulnerability Analysis

CVE-2026-43722 is an information disclosure flaw rooted in improper input validation [CWE-20] within Apple's kernel interface. The vulnerability allows an unprivileged local application to retrieve kernel state that should remain isolated from user space.

Kernel state leakage typically exposes pointers, memory layout data, or internal structures. Attackers use this information to defeat KASLR, a mitigation that randomizes kernel memory locations. Once KASLR is bypassed, memory corruption vulnerabilities elsewhere in the kernel become far easier to weaponize.

Apple's advisory states the fix involved adding input sanitization at the affected interface. This suggests untrusted parameters from user space were reaching kernel code paths without adequate bounds or type checking.

Root Cause

The root cause is missing or insufficient input sanitization at a kernel boundary. Data crossing from user space to kernel space was processed without verifying its correctness, permitting the kernel to return or expose memory contents unintentionally.

Attack Vector

Exploitation requires an attacker to run code on the target device, typically through a malicious or compromised application distributed via App Store, sideloading, or a prior compromise. The application invokes the vulnerable kernel interface with crafted inputs to trigger the leak. No user interaction beyond running the app is required.

Apple has not published proof-of-concept code, and no public exploit is available at the time of publication. See the Apple Support Article #127594 and Apple Support Article #127595 for vendor details.

Detection Methods for CVE-2026-43722

Indicators of Compromise

Applications making unusual or high-frequency system calls to kernel interfaces from unsigned or recently sideloaded binaries
Unexpected kernel extension load attempts or process crashes referencing kernel memory addresses
Applications requesting entitlements inconsistent with their declared functionality

Detection Strategies

Inventory devices running iOS, iPadOS, or macOS below version 26.5.2 using mobile device management (MDM) telemetry
Monitor endpoint behavior for applications performing anomalous kernel interaction patterns typical of information leak primitives
Correlate application installation events with subsequent kernel-related crash logs or diagnostic reports

Monitoring Recommendations

Enable MDM compliance policies that flag devices below iOS/iPadOS/macOS 26.5.2
Ingest macOS unified logs and iOS crash reports into a centralized data lake for behavioral analysis
Track application provenance and code signing status for all installed apps across the fleet

How to Mitigate CVE-2026-43722

Immediate Actions Required

Update all Apple devices to iOS 26.5.2, iPadOS 26.5.2, or macOS Tahoe 26.5.2 without delay
Enforce OS version compliance through MDM and block noncompliant devices from accessing corporate resources
Restrict sideloading and validate the provenance of all installed applications

Patch Information

Apple released fixes in iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. The patch adds input sanitization at the affected kernel interface. Refer to Apple Support Article #127594 and Apple Support Article #127595 for full advisory content and download instructions.

Workarounds

No official workaround exists; patching is the only supported remediation
Limit application installation to vetted enterprise-approved sources until updates are deployed
Apply the principle of least privilege by removing unnecessary third-party applications from managed devices

bash

# Verify macOS version meets patched baseline
sw_vers -productVersion

# Trigger MDM-based software update enforcement (example: jamf)
sudo jamf policy -event software-update