External risk intelligence

iOS iPadOS macOS and watchOS Race Condition Allows Kernel Memory Write and Unexpected Termination

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-43805

This vulnerability affects local OS components in Apple devices. While the CVE description mentions a network attack vector, the underlying issue is a race condition within client-side operating systems (iOS, iPadOS, macOS, watchOS). These are endpoint devices, not internet-facing infrastructure services, and the vulnerability requires an app to be present on the device to exploit.

Apple Ipados

before 26.614.0 to before 14.8.815.0 to before 15.7.826.0 to before 26.6

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Apple's operating systems that could allow an application to cause system instability or memory corruption. The issue stems from a race condition within the system's handling of app processes. While the attack vector is noted as network-based, the core vulnerability lies in local OS components, suggesting a reduced risk to core infrastructure but potential exposure on end-user devices.

An app could crash systems or corrupt memory.
Protects user data and ensures system stability.
Confirm relevance; risk appears low for core systems.

Attack Path

How an attacker could exploit the issue

An attacker could leverage a malicious app to exploit a race condition, potentially leading to unexpected system termination or kernel memory corruption. This vulnerability does not require special privileges or user interaction to trigger.

Requires an installed app.
Triggered by a race condition.
Risk of system termination and memory corruption.

Live Threat

Current exploitation, exposure, and threat context

A race condition in the operating system could allow an app to unexpectedly terminate the system or write to kernel memory when supported by the advisory. This may affect system stability and integrity.

System termination or kernel memory corruption.
Malicious app triggers race condition.
System instability and potential data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

For this CVE, ownership will likely fall to device owners, IT support, or mobile device management (MDM) administrators responsible for Apple endpoints. The first practical step is to confirm which Apple devices (running iOS, iPadOS, macOS, or watchOS) are in your environment, identify if they are business-critical, and then verify the specific OS versions to understand the exposure and plan for updates.

Own by device owners or MDM administrators.
Verify business-critical Apple devices and OS versions.
Plan OS updates based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software affected by CVE-2026-43805?

This vulnerability impacts core components within Apple's operating systems, specifically iOS, iPadOS, macOS (Sequoia, Sonoma, Tahoe), and watchOS. These systems serve as the foundation for mobile, desktop, and wearable devices, managing hardware resources and enabling applications to run. The flaw exists within the local OS architecture responsible for processing application requests and managing system states.

How does this race condition work?

This issue is categorized as CWE-362, which refers to a race condition. In simple terms, it happens when the operating system performs multiple operations at nearly the same time but fails to coordinate them correctly. Because of this timing gap, a malicious application can interfere with the intended order of events, potentially causing the system to crash or allowing unauthorized writes to protected kernel memory.

What triggers this vulnerability?

The flaw is triggered when a malicious application exploits the race condition within the operating system's process handling. It does not require user interaction or special administrative privileges to execute. Note that simply browsing the web or using standard system functions does not trigger this bug; it specifically requires the execution of an application that is designed to manipulate these sensitive OS processes.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that exploitation is very unlikely for core infrastructure. While the vulnerability is classified with a network attack vector, it ultimately resides in local operating system components on endpoint devices. Since it requires an application to be present on the device to initiate the exploit, the risk is centered on individual Apple hardware rather than exposed server-side network services.

Do I need to update my Apple devices?

Yes, you should verify the current OS versions on all Apple devices in your environment. As a first step, check if your devices are running the versions affected by this vulnerability. If they are, coordinate with device owners or IT administrators to plan for the necessary updates to iOS, iPadOS, macOS, or watchOS as specified in the official vendor guidance to ensure your systems remain stable and protected.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.