CVE-2026-39868: This issue was addressed with improved input validation

Synopsis

An input validation vulnerability in Apple iOS, iPadOS, and macOS allows a malicious app running on the device to corrupt kernel memory or force an unexpected system termination. The attack is launched locally, requires no authentication, and no interaction from the victim beyond running the malicious app. Successful exploitation gives an attacker the ability to tamper with kernel memory or crash the operating system entirely. A patched-image rebuild at version 26.5.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code is reached over the network or via an app delivered over the network; the attacker must be able to get a malicious app onto the target device, which requires network-based distribution.

• AuthenticationNot required

  No account credentials or privileges are required; any app running on the device can trigger the vulnerability.

• Victim interactionNot required

  No user interaction beyond running the malicious app is needed to trigger kernel memory corruption or system termination.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker can corrupt kernel memory, potentially overwriting security-critical kernel structures or data used by other processes.
• A successful attacker can force an unexpected system termination, crashing iOS, iPadOS, or macOS and denying service to all users of the affected device.
• Kernel memory corruption may be leveraged as a stepping stone to escalate privileges or achieve code execution in a privileged context, depending on what memory regions are reachable.
• Confidentiality is not directly impacted per the CVSS vector, but integrity and availability of the entire operating system are fully compromised.