CVE-2026-43687 is a vulnerability affecting Apple iOS and iPadOS where connecting to a malicious Network File System (NFS) server may lead to disclosure of kernel memory. The issue was resolved by Apple through improved memory handling in iOS 26.7, iPadOS 26.7, and subsequent versions including iOS 27 and iPadOS 27. The fix is also included in macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. This vulnerability could allow an attacker controlling an NFS server to gain unauthorized access to sensitive kernel memory information.

Successful exploitation of this vulnerability could result in unauthorized disclosure of kernel memory on affected Apple devices. This may lead to leakage of sensitive information from the kernel space, potentially aiding further attacks. There is no indication of active exploitation in the wild at this time.

Apple has released official fixes in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and corresponding versions of other Apple operating systems. Users and administrators should apply these updates promptly to remediate the vulnerability. No additional mitigation is required beyond applying the official patches.