CVE-2026-39868: Public PoC Discloses a macOS and iOS Kernel Memory Corruption Flaw

TL;DR

Apple has patched a serious macOS kernel vulnerability tracked as CVE-2026-39868. An unprivileged app can corrupt kernel memory through the DTrace subsystem. The finder, Vladislav Shevchenko of Positive Technologies, has now published full technical details and a proof-of-concept exploit.

Why it matters

The bug holds an assigned CVSS score of 9.1, near the top of the scale. It sits in Apple’s shared kernel, so iPhone, iPad, and Mac are all in scope. Because the exploit is now public, the effort to abuse this macOS kernel vulnerability has dropped sharply. A local app could crash the device or tamper with kernel memory. That primitive is a strong step toward deeper control.

How the attack works

The flaw lives in DTrace, Apple’s tracing framework. It parses a binary format called DOF. A normal, unprivileged app can stage a crafted DOF through a helper device. Later, DTrace processes that data from a trusted root context. That mismatch creates a classic confused-deputy problem. Weak section validation and an integer overflow let attacker-chosen indices slip past the checks. Those indices then act as out-of-bounds kernel pointers during probe setup, which corrupts kernel memory. No elevated permissions are needed to start.

Affected versions

The issue affects Apple systems released before the 26.5.2 updates. The researcher confirmed the bug on several recent macOS Tahoe builds. Apple credited researchers from Positive Technologies, Baidu Security, and STAR Labs SG.

Patch and mitigation

Update without delay. Apple fixed the flaw on June 29, 2026 in iOS, iPadOS, and macOS Tahoe 26.5.2. Because the proof-of-concept and full write-up are now public, treat patching as urgent. So far, no in-the-wild exploitation has been confirmed.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.