CVE-2026-65359 Overview
CVE-2026-65359 is an out-of-bounds read vulnerability [CWE-125] affecting multiple Apple operating systems. A local user can trigger the flaw to cause unexpected system termination or read kernel memory. Apple addressed the issue with improved bounds checking across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.
The vulnerability requires local access with low privileges and no user interaction. Successful exploitation exposes kernel memory contents, which attackers can use to defeat kernel address space layout randomization (KASLR) and stage follow-on privilege escalation attacks.
Critical Impact
Local attackers can read kernel memory or crash affected Apple devices, potentially leaking sensitive kernel data useful for chaining with other exploits.
Affected Products
- Apple iOS and iPadOS (fixed in 26.7 and 27)
- Apple macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27
- Apple tvOS 27, visionOS 27, and watchOS 27
Discovery Timeline
- 2026-09-14 - CVE-2026-65359 published to the National Vulnerability Database
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-65359
Vulnerability Analysis
The vulnerability is an out-of-bounds read [CWE-125] within Apple's kernel-facing code paths. When triggered from userland, the affected routine reads beyond the intended buffer boundary. The read exposes adjacent kernel memory or dereferences invalid addresses, producing either an information disclosure or a kernel panic.
Apple's advisory states the fix introduces improved bounds checking, indicating the original implementation lacked sufficient validation of index or length parameters before dereferencing a buffer. The impact is confined to confidentiality and availability; integrity is not affected because the flaw does not enable writes.
Leaked kernel memory can undermine mitigations such as KASLR and pointer authentication codes. Attackers commonly chain kernel information disclosures with a separate write primitive to achieve arbitrary code execution in the kernel.
Root Cause
The root cause is missing or insufficient bounds validation on user-controlled input before a memory read operation. The affected kernel routine accepted values that resulted in reads past the end of an allocated buffer.
Attack Vector
Exploitation requires local access to the device and a low-privileged process context. No user interaction is needed. An attacker with the ability to run arbitrary code on the device, such as through a sandboxed application, can invoke the vulnerable interface with crafted parameters to trigger the out-of-bounds read.
No public proof-of-concept code has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details beyond Apple's advisory summaries are not available. Refer to the Apple Security Advisory collection for platform-specific information.
Detection Methods for CVE-2026-65359
Indicators of Compromise
- Unexpected kernel panics or system reboots on macOS, iOS, or iPadOS devices without a corresponding hardware or driver cause.
- Repeated crash reports referencing kernel subsystems from the same non-privileged process or application.
- Presence of unpatched OS builds below iOS/iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.7, or the 27-series releases on managed endpoints.
Detection Strategies
- Collect and review macOS .ips and DiagnosticReports panic logs for recurring kernel faults tied to a specific process signature.
- Use mobile device management (MDM) inventory queries to identify devices running vulnerable OS versions and prioritize them for patching.
- Correlate crash telemetry with process execution logs to identify potentially malicious code exercising kernel interfaces.
Monitoring Recommendations
- Enable continuous OS version reporting through MDM and endpoint security tooling for the Apple fleet.
- Alert on abnormal rates of ReportCrash or SubmitDiagInfo activity that may signal repeated exploitation attempts.
- Track newly installed applications requesting entitlements that expose kernel-facing APIs.
How to Mitigate CVE-2026-65359
Immediate Actions Required
- Update all Apple devices to iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, or watchOS 27.
- Enforce automatic OS updates through MDM policies for corporate-owned Apple devices.
- Restrict installation of untrusted applications, particularly on devices holding sensitive data.
Patch Information
Apple released fixes across its platform family. Consult the vendor advisories for exact build numbers and download instructions: Apple Support Article #149034, #149035, #149036, #149037, #149038, #149041, #149042, and #149043.
Workarounds
- No vendor-supplied workaround exists; patching is the only supported remediation.
- Limit device exposure by restricting sideloading and enforcing application allowlists through MDM until updates are deployed.
- Enable Lockdown Mode on high-risk iOS, iPadOS, and macOS devices to reduce the local attack surface available to malicious applications.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
