CVE-2026-65371: Apple iPadOS Information Disclosure Flaw

CVE-2026-65371 Overview

CVE-2026-65371 is an information disclosure vulnerability affecting multiple Apple operating systems. The flaw stems from insufficient redaction of sensitive information, allowing a local application to disclose kernel memory contents. Apple addressed the issue with improved redaction logic across its platform suite.

The vulnerability is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Exploitation requires local code execution with low privileges and no user interaction. Successful exploitation leaks kernel memory, which can aid adversaries in bypassing kernel address space layout randomization (KASLR) and staging follow-on attacks.

Critical Impact
A malicious or compromised app running on an affected Apple device can read kernel memory, exposing pointers and data that support privilege escalation chains.

Affected Products

Apple iOS and iPadOS versions prior to 26.6
Apple macOS Sequoia prior to 15.8 and macOS Tahoe prior to 26.6
Apple tvOS, visionOS, and watchOS versions prior to 26.6

Discovery Timeline

2026-09-14 - CVE-2026-65371 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-65371

Vulnerability Analysis

The vulnerability resides in an Apple component that returns data to userland without adequately scrubbing kernel-owned fields. When a local app invokes the affected interface, residual kernel memory content is included in the response. Attackers can parse the returned data to recover kernel pointers, heap fragments, or other privileged state.

Information disclosed through this flaw does not by itself compromise integrity or availability. However, kernel pointer leaks defeat KASLR and lower the cost of exploiting adjacent memory corruption bugs. Chained exploitation is the primary risk profile for this class of issue on Apple platforms.

Apple's advisory text is limited to the phrase "improved redaction of sensitive information," indicating that the fix modifies the code path to strip or zero kernel-owned buffers before returning them to unprivileged callers. The specific subsystem is not disclosed in the public advisories.

Root Cause

The root cause is improper sanitization of memory returned across the kernel-user trust boundary. A structure or buffer populated in kernel context retains uninitialized or sensitive bytes when copied out to user space, exposing them to any process able to invoke the interface.

Attack Vector

The attack requires local access with the ability to run an application on the affected device. No user interaction is required. An installed app, a sideloaded binary, or malicious code running inside a sandboxed context can query the vulnerable interface and receive kernel memory in the response.

No public proof-of-concept or in-the-wild exploitation has been reported. Apple has not attributed the finding to a specific researcher in the referenced advisories.

Detection Methods for CVE-2026-65371

Indicators of Compromise

Presence of unsigned or unexpected applications on managed Apple devices that predate the patched OS baseline.
Anomalous or repeated invocations of low-level system APIs by non-system processes captured in endpoint telemetry.
MDM inventory reports showing devices running iOS, iPadOS, macOS, tvOS, visionOS, or watchOS versions below the fixed releases.

Detection Strategies

Enforce OS version baselines through mobile device management (MDM) and flag devices below the patched versions listed in the Apple advisories.
Correlate application inventory data with threat intelligence feeds to identify apps invoking uncommon kernel interfaces.
Review macOS Unified Log entries for unusual system call patterns from non-Apple-signed binaries.

Monitoring Recommendations

Ingest macOS Endpoint Security telemetry into a centralized analytics platform for retrospective hunting once indicators emerge.
Track update compliance metrics for each affected OS family and alert on devices that fall out of the supported patch window.
Monitor Apple security advisory feeds (Apple Support Advisory #128066, Apple Support Advisory #149043) for related disclosures that may share root cause.

How to Mitigate CVE-2026-65371

Immediate Actions Required

Update all affected devices to iOS 26.6, iPadOS 26.6, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, or watchOS 26.6.
Prioritize devices that install applications from outside the App Store or that host sensitive workloads such as developer tooling.
Audit installed applications and remove any that are unsigned, unknown, or no longer required.

Patch Information

Apple released fixes across its platform families as documented in Apple Support Advisory #128066, Apple Support Advisory #128067, Apple Support Advisory #128068, Apple Support Advisory #128069, Apple Support Advisory #128070, and Apple Support Advisory #149043. The vendor addressed the issue with improved redaction of sensitive information returned to userland.

Workarounds

No vendor-supplied workaround exists; apply the Apple security updates as the only supported remediation.
Restrict installation of untrusted applications through MDM configuration profiles and application allowlisting until patching completes.
Enable automatic updates on managed Apple devices to reduce exposure windows for future kernel disclosure issues.

bash

# Verify installed OS version on macOS and confirm patch level
sw_vers
# Trigger a software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart