Kernel sensitive-state information disclosure

CVE-2026-43722 technical analysis

CVE-2026-43722 is a high-severity iOS vulnerability tracked as InfoLeak. The published record describes kernel sensitive-state information disclosure affecting iOS/iPadOS < 26.5.2. In practical terms, the vulnerability should be evaluated as a specific weakness in a specific component—not as automatic evidence that every affected device can be fully compromised. The execution context, reachable interface, platform mitigations, and availability of a reliable exploit chain all shape real-world risk.

The affected surface is the iOS and iPadOS kernel itself, reached through an interface exposed to a locally installed application. Because the kernel mediates memory isolation for every process, sensitive kernel state—pointers, memory layout, or object metadata—is exactly the material an attacker needs to defeat mitigations such as KASLR before attempting a separate memory-corruption bug. Treated in isolation this is a disclosure primitive rather than code execution: it weakens the platform's exploit-mitigation posture instead of granting control on its own, which is why Apple's input-sanitization fix is scoped as a confidentiality issue. For CVE-2026-43722, the confirmed impact recorded is: Disclosure of sensitive kernel state to a locally installed application.

This record lists 2026-06-29 as the public disclosure or patch date, identifies Not publicly disclosed as the discovery information currently available, and credits Feng Xue, XGPT / ThreatBook; Hyunwoo Kim. The remediation recorded for affected users is iOS 26.5.2 and iPadOS 26.5.2. Use the references at the end of this page as the authoritative source, because vendors can revise advisories after publication.

Attack surface and exploitation prerequisites

Determine what access the initiating application, website, peripheral, or local user needs and exactly what information can cross the boundary. A kernel-state leak, user-data disclosure, and application metadata leak have materially different consequences.

A defensible assessment separates reachability, exploitation, and post-exploitation, so a component-level flaw is not described as an end-to-end device takeover. Compensating controls—network segmentation, application allow-listing, restricted messaging or browsing features, and MDM-enforced patching—can reduce exposure, but the durable resolution remains the vendor update identified in this record.

Detection and forensic triage

A sandboxed app reading kernel state leaves almost no user-visible symptom, so triage is evidence-led rather than behavioural. Capture a sysdiagnose while the suspect app is still installed, record the exact iOS or iPadOS build against the 26.5.2 fixed release, and preserve the app container and its provenance—App Store receipt, sideload, or MDM profile—before removal. The forensic value here is attribution of which application held the capability, not a crash signature, so avoid restoring or updating the device until acquisition is complete.

Absence of a visible symptom does not prove absence of exploitation, and a crash alone does not prove compromise. Preserve device state, record the operating-system build and patch level, and acquire logs using a method appropriate to the legal context—resetting or repeatedly testing the device can destroy useful traces. When assessing a suspected targeted attack, correlate device evidence with account sign-ins, messaging metadata, network telemetry, and MDM events to separate attempted delivery from successful exploitation.

How to mitigate CVE-2026-43722

The primary mitigation is straightforward: Update supported iPhone and iPad devices to iOS 26.5.2 or iPadOS 26.5.2 or later.

On Apple devices, confirm the exact iOS or iPadOS build in Settings > General > About and compare it with Apple's security release documentation. Hardware generation and the supported update branch can change which fixed release is available. Lockdown Mode can reduce selected attack surfaces for users facing sophisticated targeted threats, but it is not a substitute for installing security updates.

1. Identify the exact device model, operating-system build, and current security patch level.
2. Compare that information with the affected range and fixed release documented by the vendor.
3. Back up necessary evidence before making changes when compromise is suspected.
4. Install the latest supported security release rather than stopping at the first version that mentions the CVE.
5. Verify the installed build after reboot and review related accounts and applications for follow-on activity.

PoC interpretation and research notes

This page distinguishes public disclosure from independent reproduction. Its current status is Vendor confirmed. Confirmed in Apple's security advisory. No public proof of concept is included in this record. Any PoC shown above should be reviewed in an isolated lab and used only on systems the researcher owns or is explicitly authorized to test. Public availability is not a guarantee that code is safe, complete, or accurately attributed.

Frequently asked questions about CVE-2026-43722

What is CVE-2026-43722?

CVE-2026-43722 is a iOS InfoLeak vulnerability associated with kernel sensitive-state information disclosure. It affects iOS/iPadOS < 26.5.2, according to the currently cited disclosures. The practical risk depends on the vulnerable component, required access, available mitigations, and whether the device has received iOS 26.5.2 and iPadOS 26.5.2.

Is CVE-2026-43722 being exploited in the wild?

The status on this page is “Vendor confirmed.” A vendor-confirmed vulnerability is not necessarily known to be actively exploited. This database uses “Exploited in the wild” only when a cited vendor or authoritative security source reports observed exploitation; public PoC availability is tracked separately.

How do I protect a device from CVE-2026-43722?

Install the latest supported security update and verify the resulting build or patch level. The recorded minimum resolution is iOS 26.5.2 and iPadOS 26.5.2. Apply relevant compensating controls while updates are pending, but do not treat configuration changes as equivalent to patching the underlying vulnerability.