CVE-2026-43724: Apple iPadOS DOS Vulnerability

CVE-2026-43724 Overview

CVE-2026-43724 is a local privilege-impacting vulnerability affecting Apple iOS, iPadOS, and macOS. The flaw stems from insufficient input sanitization [CWE-20] in a kernel-adjacent component. A local application can trigger the condition to cause unexpected system termination or write to kernel memory. Apple addressed the issue in iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2 through improved input sanitization.

The vulnerability requires local access with low privileges and no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the affected system.

Critical Impact
A local, low-privileged application can write to kernel memory, enabling kernel-level compromise and potential privilege escalation on unpatched Apple devices.

Affected Products

Apple iOS versions prior to 26.5.2
Apple iPadOS versions prior to 26.5.2
Apple macOS Tahoe versions prior to 26.5.2

Discovery Timeline

2026-06-29 - CVE-2026-43724 published to the National Vulnerability Database
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-43724

Vulnerability Analysis

CVE-2026-43724 is an Improper Input Validation vulnerability [CWE-20] impacting Apple operating system kernels. According to Apple's advisories, an application may be able to cause unexpected system termination or write kernel memory. This class of bug typically arises when kernel interfaces trust user-supplied parameters without validating length, type, or range before using them in memory operations.

The attack surface is local, meaning the attacker must already have code execution on the device, such as through a malicious or compromised application. Once triggered, the bug allows writes into kernel address space, which can corrupt kernel data structures or overwrite function pointers.

Root Cause

Apple's advisory attributes the fix to "improved input sanitization," indicating the original code path accepted untrusted input from user space without sufficient validation. The lack of validation permits the kernel to perform an operation using attacker-controlled values, resulting in either a system crash or an out-of-bounds kernel memory write.

Attack Vector

An attacker delivers a malicious application to the target device through standard distribution channels or exploits an existing app running with normal privileges. The application issues a specially crafted request to the vulnerable kernel interface. The kernel processes the unsanitized input, producing either a denial-of-service through system termination or an arbitrary kernel memory write. A kernel write primitive is a common building block for sandbox escape and privilege escalation to root or kernel level.

No public proof-of-concept or exploit code is currently referenced for CVE-2026-43724. Consult the Apple Support Article 127594 and Apple Support Article 127595 for vendor-provided details.

Detection Methods for CVE-2026-43724

Indicators of Compromise

Unexpected kernel panics or spontaneous device reboots recorded in system diagnostic logs, particularly PanicFullDump entries referencing the affected subsystem.
Applications repeatedly invoking uncommon system calls or IOKit user-client interfaces prior to a crash event.
Presence of unsigned or ad-hoc signed binaries on macOS endpoints that trigger kernel diagnostic reports.

Detection Strategies

Inventory Apple endpoints and flag devices running iOS, iPadOS, or macOS Tahoe below version 26.5.2 using mobile device management (MDM) reporting.
Collect and centralize crash reports from /Library/Logs/DiagnosticReports/ on macOS and equivalent iOS diagnostic feedback to identify anomalous kernel terminations.
Correlate application launch telemetry with subsequent kernel panics to identify suspect processes.

Monitoring Recommendations

Enable endpoint telemetry that captures kernel extension activity, IOKit interactions, and process crash events on macOS.
Monitor MDM compliance dashboards for devices failing to install the 26.5.2 update within your patch SLA.
Alert on repeated kernel panic signatures across multiple endpoints, which may indicate exploitation attempts at scale.

How to Mitigate CVE-2026-43724

Immediate Actions Required

Update all iPhones to iOS 26.5.2, iPads to iPadOS 26.5.2, and Macs to macOS Tahoe 26.5.2 immediately.
Enforce update compliance through MDM policies and block non-compliant devices from accessing sensitive corporate resources.
Restrict installation of applications from untrusted sources and review sideloaded or enterprise-signed applications on managed fleets.

Patch Information

Apple released fixes in iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. Refer to Apple Support Article 127594 and Apple Support Article 127595 for full release notes and download instructions. The vendor addressed the root cause with improved input sanitization in the affected kernel code path.

Workarounds

No official vendor workaround exists. Apply the 26.5.2 updates as the primary remediation.
Reduce exposure by limiting installation of third-party applications and enforcing application allow-listing on managed endpoints.
On macOS, ensure System Integrity Protection (SIP) and Gatekeeper remain enabled to raise the bar for attacker tooling.

bash

# Verify current OS version on macOS
sw_vers -productVersion

# Trigger software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart

# Query MDM inventory for non-compliant iOS/iPadOS devices
# (example pseudo-command; adapt to your MDM API)
mdm-cli devices list --os-version-below 26.5.2