CVE-2026-65349: Apple iPadOS Use-After-Free Vulnerability

CVE-2026-65349 Overview

CVE-2026-65349 is an out-of-bounds read vulnerability [CWE-125] affecting Apple iOS, iPadOS, and macOS. A local application can exploit improper input validation to trigger unexpected system termination or read kernel memory. Apple addressed the flaw by adding stricter input validation in iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2.

The issue requires local access and user interaction, and it impacts the confidentiality of kernel memory contents while creating a denial-of-service condition through system termination.

Critical Impact
A malicious application running locally can read kernel memory or crash the system, potentially exposing sensitive kernel data useful for chaining additional exploits.

Affected Products

Apple iOS (versions prior to 26.6.1)
Apple iPadOS (versions prior to 26.6.1)
Apple macOS Tahoe (versions prior to 26.6.2)

Discovery Timeline

2026-08-17 - CVE-2026-65349 published to the National Vulnerability Database (NVD)
2026-08-18 - Last updated in the NVD database

Technical Details for CVE-2026-65349

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in an Apple operating system component shared across iOS, iPadOS, and macOS. An installed application can supply crafted input that causes a kernel-mode routine to read memory outside the bounds of an intended buffer.

Because the flawed code path executes with kernel privileges, the read can expose sensitive kernel memory or destabilize the kernel enough to trigger an unexpected system termination. Attackers frequently combine out-of-bounds reads with separate write primitives to defeat kernel address space layout randomization (KASLR) and stage larger exploit chains.

Root Cause

Affected kernel code paths accept attacker-controlled input without validating length or index boundaries before dereferencing an internal buffer. The absence of bounds checks allows a read past the allocated region. Apple's advisories describe the fix as "improved input validation," indicating additional guard logic was introduced before the memory access.

Attack Vector

Exploitation requires a local attack vector with low privileges and user interaction, such as installing or launching a malicious application. The application invokes the vulnerable interface with malformed parameters to force the kernel into the out-of-bounds read. Successful exploitation yields either a kernel information disclosure or an availability impact through system termination.

No verified proof-of-concept code is publicly available. See the Apple Support Article #148281 and Apple Support Article #148282 for vendor guidance.

Detection Methods for CVE-2026-65349

Indicators of Compromise

Repeated unexpected kernel panics or system reboots on macOS, iOS, or iPadOS devices running versions prior to the fixed builds.
Installation of unsigned or side-loaded applications that invoke privileged kernel interfaces shortly before crashes.
Panic logs referencing invalid memory access, EXC_BAD_ACCESS, or bounds-related faults in kernel extensions.

Detection Strategies

Collect and analyze macOS panic reports in /Library/Logs/DiagnosticReports/ for kernel faults following recent application installations.
Monitor Mobile Device Management (MDM) telemetry for iOS and iPadOS device crash events correlated with newly installed applications.
Baseline application behavior against normal system-call patterns and flag processes issuing repeated malformed kernel requests.

Monitoring Recommendations

Track OS build versions across the fleet and alert on endpoints running iOS/iPadOS below 26.6.1 or macOS below Tahoe 26.6.2.
Forward endpoint diagnostic logs and application inventory data to a centralized data lake for cross-device correlation.
Review App Store and enterprise application deployments for untrusted publishers targeting recently patched interfaces.

How to Mitigate CVE-2026-65349

Immediate Actions Required

Update all iPhone and iPad devices to iOS 26.6.1 or iPadOS 26.6.1.
Update Mac systems running macOS Tahoe to version 26.6.2.
Restrict installation of untrusted or side-loaded applications through MDM configuration profiles.
Prioritize patching on devices used by administrators, developers, and privileged users.

Patch Information

Apple resolved the issue in iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2 by adding input validation to the affected code path. Deployment details are documented in Apple Support Article #148281 and Apple Support Article #148282.

Workarounds

No official workaround exists; applying the vendor patch is the only complete remediation.
Limit application installation to vetted sources such as the Apple App Store and approved MDM catalogs.
Enforce Lockdown Mode on high-risk iOS and iPadOS devices to reduce the attack surface for untrusted code.

bash

# Verify current OS build on macOS
sw_vers

# Trigger a software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart

# Example MDM query to enumerate iOS/iPadOS devices below 26.6.1
# (pseudo-query, adjust to your MDM syntax)
# SELECT device_id, os_version FROM devices
# WHERE platform IN ('iOS','iPadOS') AND os_version < '26.6.1';