CVE-2026-65358: Apple iPadOS Race Condition Vulnerability

CVE-2026-65358 Overview

CVE-2026-65358 is a race condition vulnerability affecting multiple Apple operating systems. Apple addressed the flaw with improved state handling across its platform portfolio. A local application can trigger the race window to cause unexpected system termination, resulting in a denial-of-service condition on the affected device.

The issue is categorized under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization). Exploitation requires local access and low privileges, but the attack complexity is high due to timing constraints inherent to race conditions.

Critical Impact
A local app can cause unexpected system termination across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, disrupting device availability.

Affected Products

Apple iOS and iPadOS (fixed in iOS 27 and iPadOS 27)
Apple macOS (fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7)
Apple tvOS 27, visionOS 27, and watchOS 27

Discovery Timeline

2026-09-14 - CVE-2026-65358 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-65358

Vulnerability Analysis

CVE-2026-65358 stems from improper synchronization between concurrent execution paths that access shared state. When two or more threads operate on the same resource without adequate locking, the resulting inconsistent state can drive the kernel or a privileged system service into a fault condition. Apple's advisories describe the fix as "improved state handling," indicating that the corrective patch adds ordering or locking guarantees around the affected transitions.

The outcome is unexpected system termination. This behavior is consistent with a kernel panic or forced restart of a critical process, both of which disrupt device availability. The vulnerability does not expose confidentiality or integrity impact according to the published CVSS vector.

Root Cause

The root cause is a race condition [CWE-362] in a shared code path present across Apple's platform families. Because the same defect affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, the vulnerable component likely resides in shared kernel or system framework code common to all Darwin-based operating systems.

Attack Vector

An attacker must run a local application on the target device to exploit CVE-2026-65358. The application races operations against a shared resource to force an inconsistent state. The high attack complexity reflects the timing precision required to reliably win the race. Successful exploitation terminates the system rather than executing attacker-controlled code.

No public exploit, proof-of-concept, or CISA Known Exploited Vulnerabilities (KEV) entry exists for CVE-2026-65358 at the time of publication. See the Apple Support advisories for vendor technical details.

Detection Methods for CVE-2026-65358

Indicators of Compromise

Unexpected kernel panics or forced restarts on iOS, iPadOS, macOS, tvOS, visionOS, or watchOS devices running pre-patch versions
Panic logs referencing lock contention, state assertion failures, or concurrent access faults in shared kernel components
Repeated crash reports tied to a specific third-party application executing tight loops or high-frequency system calls

Detection Strategies

Collect and centrally review panic-full-*.ips logs from macOS endpoints and diagnostic reports from iOS device management
Correlate crash reports with the installed application inventory to identify applications repeatedly present at the time of termination
Baseline system reliability metrics per device and alert on statistically abnormal crash-rate spikes following new application installs

Monitoring Recommendations

Ingest Apple diagnostic reports and MDM crash telemetry into your SIEM for longitudinal analysis
Monitor App Store and enterprise-signed application installations for applications requesting elevated system interactions
Track OS build numbers in your fleet inventory to confirm coverage against the fixed versions listed by Apple

How to Mitigate CVE-2026-65358

Immediate Actions Required

Upgrade devices to iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, or watchOS 27
Enforce OS update compliance through your Mobile Device Management (MDM) platform
Audit installed applications and remove untrusted or unnecessary third-party software that runs privileged workloads

Patch Information

Apple has released patches across its platform families. Refer to the vendor advisories for platform-specific details: Apple Support Article #149034, #149035, #149036, #149037, #149038, #149042, and #149043.

Workarounds

No vendor-supplied workaround is documented; patching is the required remediation
Restrict installation of unverified applications through MDM configuration profiles until updates are deployed
Enable automatic OS updates on managed and unmanaged Apple devices to reduce exposure windows