CVE-2026-65344: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-65344 Overview

CVE-2026-65344 is an out-of-bounds write vulnerability [CWE-787] affecting Apple's video file processing components across iOS, iPadOS, macOS, tvOS, and visionOS. Processing a maliciously crafted video file may lead to unexpected application termination and potential memory corruption. Apple addressed the issue with improved bounds checking in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, and visionOS 27.

Critical Impact
Local attackers can trigger memory corruption by delivering a crafted video file, resulting in application termination and possible code execution within the media processing context.

Affected Products

Apple iOS and iPadOS (prior to 26.7 and 27)
Apple macOS (Sequoia prior to 15.8, Tahoe prior to 26.7, Golden Gate prior to 27)
Apple tvOS (prior to 27) and visionOS (prior to 27)

Discovery Timeline

2026-09-14 - CVE-2026-65344 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-65344

Vulnerability Analysis

The vulnerability resides in Apple's video file parsing logic, where insufficient bounds validation permits writes beyond the allocated buffer. When the parser processes attacker-controlled fields inside a malformed video container, it computes offsets or sizes that fall outside the intended memory region. The write operation then corrupts adjacent memory, causing unexpected termination of the media handling process.

The issue is classified as an out-of-bounds write [CWE-787], one of the most impactful memory safety weaknesses in modern software. Because Apple's media frameworks are shared across iOS, macOS, tvOS, and visionOS, a single flaw in shared decoder code propagates across the entire ecosystem.

Root Cause

The root cause is missing or inadequate validation of size and offset values parsed from an untrusted video file. The decoder trusted attacker-supplied metadata when computing destination buffer indexes. Apple's fix introduces stricter bounds checks before performing memory writes, ensuring that indexes remain within allocated regions.

Attack Vector

Exploitation requires the victim to open or preview a crafted video file using an application that leverages Apple's media frameworks. The attack requires local file processing and user interaction, matching the local attack vector described in the advisory. Successful exploitation yields high impact to confidentiality, integrity, and availability of the affected process.

Apple has not disclosed exploitation in the wild, and no public proof-of-concept exists at the time of publication. See the Apple Support advisories for platform-specific technical notes.

Detection Methods for CVE-2026-65344

Indicators of Compromise

Repeated crashes of media-related processes such as AVFoundation, CoreMedia, QuickTime, or Preview when opening a specific video file
Crash reports in ~/Library/Logs/DiagnosticReports/ referencing EXC_BAD_ACCESS or out-of-bounds write signatures in media frameworks
Unexpected termination of third-party applications that embed Apple media decoders after handling untrusted video content

Detection Strategies

Monitor endpoint telemetry for abnormal media framework crashes correlated with the arrival of new video files via email, messaging, or web downloads
Inspect video files for malformed atom or box structures inconsistent with the declared container format
Correlate crash events with process ancestry to identify whether the video was delivered by a browser, mail client, or messaging application

Monitoring Recommendations

Ingest macOS unified logs and crash reports into a centralized analytics pipeline to identify recurring media parsing failures across the fleet
Track deployment status of iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, and visionOS 27 to identify unpatched devices
Alert on media parser crashes originating from files with suspicious provenance, such as unsolicited attachments

How to Mitigate CVE-2026-65344

Immediate Actions Required

Apply Apple's security updates to all affected iOS, iPadOS, macOS, tvOS, and visionOS devices as soon as feasible
Prioritize patching for devices handling untrusted video content, including executive endpoints and shared workstations
Educate users to avoid opening video files from unknown or untrusted sources until patching is complete

Patch Information

Apple resolved CVE-2026-65344 by adding improved bounds checking in the affected media processing code paths. Fixed releases include iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, and visionOS 27. Refer to Apple's advisories for platform-specific details: Apple Support #149034, #149035, #149036, #149038, #149041, #149042, and #149043.

Workarounds

Restrict processing of video files from untrusted sources until the security update is installed
Configure email and messaging gateways to inspect or quarantine unusual video attachments
Disable automatic media previews in file managers and messaging clients on unpatched systems

bash

# Verify installed macOS version and apply pending updates
sw_vers -productVersion
sudo softwareupdate --install --all --restart