Executive brief
Apple has released security updates for iPhone, iPad, and Mac to address a vulnerability that could allow a malicious application to access sensitive system information. This flaw affects the kernel, which is the core part of the operating system that manages hardware and software interactions. If exploited, an app could leak internal system states that are normally protected, potentially aiding in more complex attacks.
Technical details
An information disclosure vulnerability exists in the Apple kernel across iOS, iPadOS, and macOS Tahoe. The issue stems from improper input sanitization, which can be exploited by a malicious application to leak sensitive kernel state information. This type of vulnerability is typically used by attackers to bypass security protections like Address Space Layout Randomization (ASLR) to facilitate further exploitation. The issue was addressed in iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2 by improving input validation.
Affected products
- Apple iOS and iPadOS < 26.5.2
- Apple macOS Tahoe < 26.5.2
Timeline
- 2026-06-29: disclosed
- 2026-06-29: patched