CVE-2026-39877
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to disclose kernel memory.
Risk Assessment
An app may be able to access kernel memory, which could lead to disclosure of sensitive system information and potentially enable further attacks.
Recommendation
It is recommended to update systems to the latest versions mentioned in the description to prevent kernel memory disclosure.
Other vulnerabilities in Apple operating systems
See all- CVE-2023-40403Medium
The issue was addressed with improved memory handling. It is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information.
- CVE-2026-64774Critical
An integer overflow vulnerability was addressed with improved input validation. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64772Critical
An out-of-bounds write issue was addressed with improved input validation. Affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64771Critical
A buffer overflow vulnerability was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64770Critical
An out-of-bounds write issue was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64769Critical
An out-of-bounds write issue was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64746Critical
An authorization issue was addressed with improved validation. Affects iOS, iPadOS, macOS, visionOS, and watchOS. An app may add contacts without user authorization.
- CVE-2026-64726Critical
The issue was addressed with improved memory handling. Affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An attacker in physical proximity may corrupt process memory.
- CVE-2026-43812Critical
A use after free issue was addressed with improved memory management. Affects iOS, iPadOS, macOS, tvOS, and visionOS. An app may cause unexpected system termination.
- CVE-2026-43809Critical
An out-of-bounds read was addressed with improved bounds checking. Affects iOS, iPadOS, macOS. An app may cause unexpected system termination.
Original NVD description (English source)
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to disclose kernel memory.