CVE-2026-43724
HIGH 7.8 ALL-YEARSThe issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.
Severe if exploited (CVSS 7.8), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 6th percentile
Impact if exploited
7.8CVSS 3.1 · HIGH · ADP
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
- CWE-20: Improper Input Validation
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References and research data (JSON)
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
2 candidates
- https://github.com/gracecondition/DirtySlide
DirtySlide XNU Exploit (CVE-2026-43724) For MacOS
PoC-in-GitHub · CVE-2026-43724
PoC-in-GitHub · CVE-2026-43724 · Updated 2026-10-23T15:14:54Z - https://github.com/impost0r/Rie
CVE-2026-43724 - Apple's published enough advisories about the issue, I'm not getting paid for any of my kernel bugs.
PoC-in-GitHub · CVE-2026-43724
PoC-in-GitHub · CVE-2026-43724 · Updated 2026-10-15T14:23:35Z
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Apple | Ipados | < 26.5.2 |
| Apple | Iphone Os | < 26.5.2 |
| Apple | Macos | ≥ 26.0 and < 26.5.2 |
All CVSS metrics
- HIGH 7.8 v3.1 · ADP Primary
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - HIGH 7.8 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Advisories
- https://support.apple.com/en-us/127594 CVE record · apple · Updated 2026-08-17T21:30:35.040Z
NVD · CVE-2026-43724 · Updated 2026-08-17T22:17:08.607 - https://support.apple.com/en-us/127595 CVE record · apple · Updated 2026-08-17T21:30:35.040Z
NVD · CVE-2026-43724 · Updated 2026-08-17T22:17:08.607 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40203 EUVD · EUVD-2026-40203
Technical & other
- https://support.apple.com/en-us/128068CVE record · apple · Updated 2026-08-17T21:30:35.040Z
NVD · CVE-2026-43724 · Updated 2026-08-17T22:17:08.607 - https://support.apple.com/en-us/128069CVE record · apple · Updated 2026-08-17T21:30:35.040Z
NVD · CVE-2026-43724 · Updated 2026-08-17T22:17:08.607 - https://support.apple.com/en-us/128070CVE record · apple · Updated 2026-08-17T21:30:35.040Z
NVD · CVE-2026-43724 · Updated 2026-08-17T22:17:08.607 - https://support.apple.com/en-us/128071CVE record · apple · Updated 2026-08-17T21:30:35.040Z
NVD · CVE-2026-43724 · Updated 2026-08-17T22:17:08.607 - https://support.apple.com/en-us/128072CVE record · apple · Updated 2026-08-17T21:30:35.040Z
NVD · CVE-2026-43724 · Updated 2026-08-17T22:17:08.607 - https://support.apple.com/en-us/148287CVE record · apple · Updated 2026-08-17T21:30:35.040Z
NVD · CVE-2026-43724 · Updated 2026-08-17T22:17:08.607
Sources: NVD · CVE.org · All sources and attribution · EPSS