CVE-2026-437247.8High

CVE-2026-43724: Apple iOS and iPadOS vulnerability

Apple · iOS and iPadOS

Vendor fix available · Affected: Apple iOS and iPadOS · Exploitation: public proof of concept (unverified)

ExploitationProof of concept public

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

In CISA KEV: not seen
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public2 public GitHub repositories (unverified), listed by PoC-in-GitHub30 Jun
Not established: not seen

0.2%probability of exploitation in the next 30 days

5th percentile

050100

Higher than 5% of scored CVEs

7.8HighCVSS

LowMediumHighCrit.

DescriptionNVD

The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Input Validation · Input Validation and Logic
Vendor: Apple
Published: June 2026
Band: Unlikely (under 1%), June 2026

What changed

30 Jun
PoC-in-GitHub lists 2 public GitHub repositories (unverified) PoC-in-GitHub

Coverage1 article · 1 outlet

First in our coverage: thezdi.com, 1 Jul.

1 Jul 16:02
Apple patches 37 WebKit kernel flaws, including sandbox escapes
thezdi.com · first in our coverage

New articles also arrive in the RSS feed.