CVE-2026-65357: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-65357 Overview

CVE-2026-65357 is a memory corruption vulnerability affecting multiple Apple operating systems. A local application can trigger unexpected system termination or write to kernel memory. Apple addressed the issue with improved memory handling across its platform ecosystem. The flaw is categorized under [CWE-120] Buffer Copy without Checking Size of Input.

Apple fixed the vulnerability in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Exploitation requires local access and low privileges but does not require user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the affected device.

Critical Impact
A locally installed application can corrupt kernel memory, leading to full device compromise or persistent denial of service.

Affected Products

Apple iOS and iPadOS (versions prior to 26.6)
Apple macOS Tahoe (versions prior to 26.6)
Apple tvOS, visionOS, and watchOS (versions prior to 26.6)

Discovery Timeline

2026-09-14 - CVE-2026-65357 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-65357

Vulnerability Analysis

The vulnerability resides in a kernel-adjacent component shared across Apple's operating systems. An unprivileged local application can trigger a memory handling error that allows the process to write into kernel memory or force an unexpected system shutdown. The attack surface is reachable from userland, meaning any sandboxed or non-sandboxed app on the device can attempt exploitation.

Apple's advisory attributes the fix to improved memory handling, consistent with mitigations for buffer copy operations that lack proper bounds enforcement. Writing to kernel memory from user context breaks the fundamental privilege boundary between userland and the kernel. An attacker can leverage this primitive to escalate privileges, disable security controls, or install persistent implants.

Root Cause

The underlying weakness maps to [CWE-120], a classic buffer copy without checking the size of the input. When user-supplied data is copied into a kernel buffer without validating its length against the destination size, adjacent memory is overwritten. This can corrupt kernel data structures, function pointers, or return addresses.

Attack Vector

Exploitation requires a local attacker who can execute code on the target device, typically through a malicious app. The attacker crafts input that overflows the vulnerable buffer, either destabilizing the kernel to cause a panic or overwriting specific memory regions to gain elevated capabilities. No user interaction is required beyond running the malicious application.

Detailed exploitation code is not publicly available. Refer to the Apple Security Releases page for advisory details.

Detection Methods for CVE-2026-65357

Indicators of Compromise

Unexpected kernel panics or system reboots on Apple devices running versions prior to 26.6
Crash logs referencing memory access violations in kernel-mode components
Installation of unsigned or side-loaded applications from untrusted sources preceding system instability

Detection Strategies

Collect and analyze Apple device crash reports and panic logs for repeated kernel faults tied to a specific application bundle identifier
Monitor Mobile Device Management (MDM) telemetry for devices reporting OS versions below 26.6
Correlate application install events with subsequent system termination events in endpoint telemetry

Monitoring Recommendations

Enforce MDM compliance policies that flag devices running vulnerable OS versions
Aggregate crash and diagnostic logs from managed Apple endpoints into a centralized analytics platform
Alert on newly installed applications from unverified developers on managed corporate devices

How to Mitigate CVE-2026-65357

Immediate Actions Required

Update all affected Apple devices to iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, or watchOS 26.6
Audit managed device fleets and prioritize patching endpoints that permit app side-loading or run untrusted third-party applications
Restrict installation of unvetted applications through MDM configuration profiles until patching is complete

Patch Information

Apple released fixes in the 26.6 update train across its operating systems. Refer to the vendor advisories: Apple Support Document #128066, #128067, #128068, #128069, and #128070.

Workarounds

No vendor-supplied workaround exists; applying the 26.6 update is the only supported remediation
Limit app installations to the Apple App Store and reject provisioning profiles from unknown developers
Enable automatic OS updates on managed devices to reduce exposure windows for future kernel-level issues

bash

# Verify installed OS version on macOS
sw_vers -productVersion

# Trigger a software update check on macOS
sudo softwareupdate --install --all --restart