This vulnerability (CVE-2026-43655) involves an out-of-bounds read in Apple operating systems including iOS and iPadOS. The flaw arises from inadequate bounds checking, which could be exploited by an app to cause unexpected system termination or to read kernel memory, potentially leading to information disclosure or denial of service. Apple fixed this issue in version 26.5 of iOS, iPadOS, macOS Tahoe, tvOS, and watchOS by improving bounds checking mechanisms. The CVSS v3.1 score is 7.3, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

An attacker who successfully exploits this vulnerability could cause the affected device to crash unexpectedly or read sensitive kernel memory, potentially leading to information disclosure or system instability. The vulnerability affects multiple Apple operating systems prior to version 26.5. There are no reports of active exploitation in the wild.

Apple has released version 26.5 for iOS, iPadOS, macOS Tahoe, tvOS, and watchOS which includes a fix for this vulnerability by improving bounds checking. Users and administrators should update affected devices to version 26.5 or later to remediate this issue. Patch status is confirmed by the vendor advisory indicating an official fix is available.