CVE-2026-39868

Published Jun 29, 2026

Last updated 21 days ago

CVSS critical 9.1

iPadOS

iOS

macOS

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-39868 is a kernel vulnerability affecting macOS and other Apple operating systems, including iOS, iPadOS, tvOS, visionOS, and watchOS. This flaw resides within Apple's DTrace subsystem, which is a dynamic tracing framework. An unprivileged application can exploit this vulnerability to corrupt kernel memory. The vulnerability stems from insufficient input validation within DTrace when processing a binary format called DOF. A crafted DOF can be staged by a normal, unprivileged application, and when DTrace processes this data from a trusted root context, it can lead to a confused-deputy problem. Weak section validation and an integer overflow allow attacker-chosen indices to bypass checks, resulting in out-of-bounds kernel pointers during probe setup and subsequent kernel memory corruption. Apple addressed this issue with improved input validation and released fixes in updates such as iOS 26.5.2, iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. A proof-of-concept exploit for CVE-2026-39868 has been publicly disclosed.

Description: This issue was addressed with improved input validation. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or corrupt kernel memory.
Source: product-security@apple.com
NVD status: Modified
Products: ipados, iphone_os, macos

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Severity: CRITICAL

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-20

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "DB0D3014-6223-4BE5-B8D5-C8A17326859D",
            "versionEndExcluding": "26.5.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "237EDA63-32B7-40AA-8EDD-726EC67EAE38",
            "versionEndExcluding": "26.5.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "32D958E9-AA46-4ED6-A8F3-ADE50F3C31AD",
            "versionEndExcluding": "26.5.2",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.