CVE-2026-65367: Apple iPadOS Use-After-Free Vulnerability

CVE-2026-65367 Overview

CVE-2026-65367 is a null pointer dereference vulnerability [CWE-476] affecting Apple iOS and iPadOS. A locally installed app can trigger unexpected system termination by exploiting improper input validation. Apple addressed the flaw with additional input validation checks in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, and iPadOS 26.5.

The vulnerability requires local access and low privileges but no user interaction. Successful exploitation results in a denial of service condition affecting device availability. Confidentiality and integrity are not impacted.

Critical Impact
A malicious or malformed app can cause unexpected system termination on unpatched iOS and iPadOS devices, disrupting availability until the device is restarted.

Affected Products

Apple iOS versions prior to 18.7.9
Apple iPadOS versions prior to 18.7.9
Apple iOS and iPadOS versions prior to 26.5

Discovery Timeline

2026-08-25 - CVE-2026-65367 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-65367

Vulnerability Analysis

The defect is a null pointer dereference in an iOS/iPadOS component that fails to validate input before dereferencing an object pointer. When a local app supplies crafted input, the affected code path reads or writes through a pointer that has not been initialized or has been set to null. The kernel or system process then encounters an invalid memory access and terminates.

The result is an availability impact only. The bug does not disclose memory contents or allow code execution because the fault path traps before any secondary corruption occurs. Apple's advisories describe the fix as improved input validation, indicating the patched code now checks pointer validity or rejects malformed input before use.

The attack surface is limited to apps already running on the device. Sandbox restrictions still apply, but the crash originates in a system component reachable from unprivileged app contexts.

Root Cause

The root cause is missing input validation in a system routine that assumes a caller-supplied structure or pointer is non-null. Under specific malformed inputs, the pointer remains null and the subsequent dereference triggers the fault. This maps directly to CWE-476: NULL Pointer Dereference.

Attack Vector

Exploitation requires local access with low privileges. An attacker must deliver and execute an app on the target device, for example through side-loading, enterprise provisioning, or a malicious app that reaches distribution. No user interaction is required after the app runs. The exploit produces a denial of service by terminating a system process or forcing a device reboot.

No public proof-of-concept, exploit code, or CISA KEV listing is associated with this CVE at time of publication.

Detection Methods for CVE-2026-65367

Indicators of Compromise

Unexpected system termination events, respring cycles, or device reboots correlated with recently installed or updated apps.
Repeated crash reports referencing a common system framework across multiple devices in the fleet.
Presence of apps installed from outside the App Store on devices running iOS or iPadOS earlier than 18.7.9 or 26.5.

Detection Strategies

Collect and centralize iOS crash logs through mobile device management (MDM) and inspect for EXC_BAD_ACCESS or SIGSEGV signals tied to null address references.
Correlate crash timestamps with app install, launch, or foreground events to identify a triggering app.
Track OS version compliance across managed devices and flag endpoints below the patched builds.

Monitoring Recommendations

Enable crash reporting forwarding from MDM to a centralized log platform for fleet-wide visibility.
Alert on recurring system terminations from the same app bundle identifier across multiple users.
Monitor app inventory for unsigned, side-loaded, or newly enrolled enterprise apps on managed devices.

How to Mitigate CVE-2026-65367

Immediate Actions Required

Update all iPhone and iPad devices to iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, or iPadOS 26.5 or later.
Enforce the patched minimum OS version through MDM compliance policies and block non-compliant devices from corporate resources.
Review installed apps and remove untrusted or unnecessary third-party applications, particularly side-loaded or enterprise-signed apps.

Patch Information

Apple released fixes in iOS 18.7.9 and iPadOS 18.7.9, and in iOS 26.5 and iPadOS 26.5. Details are available in Apple Support Article #127110 and Apple Support Article #127111.

Workarounds

Restrict app installation to the App Store and disable enterprise or developer provisioning where operationally feasible.
Use MDM to block installation of unapproved apps until devices are updated to a patched OS build.
Educate users to avoid installing untrusted apps and to report unexpected device restarts to the security team.

bash

# Example MDM compliance policy expression to require patched iOS builds
require os_version >= "18.7.9" or os_version >= "26.5"
deny access if os_version < "18.7.9"