CVE-2026-65395: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-65395 Overview

CVE-2026-65395 is an out-of-bounds write vulnerability [CWE-787] affecting image processing across Apple's operating system ecosystem. Processing a maliciously crafted image can trigger memory corruption on vulnerable devices. Apple addressed the flaw with improved bounds checking across iOS, iPadOS, macOS, tvOS, and visionOS.

The issue requires user interaction, such as opening or previewing a malicious image file. Successful exploitation impacts availability by corrupting process memory. Apple has released coordinated patches through multiple platform updates documented in support articles 149034 through 149043.

Critical Impact
A crafted image processed by a vulnerable Apple device can write outside allocated memory bounds, leading to application crashes or memory corruption that may enable further exploitation.

Affected Products

Apple iOS and iPadOS (fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27)
Apple macOS (fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27)
Apple tvOS 27 and visionOS 27

Discovery Timeline

2026-09-14 - CVE-2026-65395 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-65395

Vulnerability Analysis

The flaw resides in Apple's shared image parsing code path used across iOS, iPadOS, macOS, tvOS, and visionOS. When the decoder processes a specially crafted image, insufficient bounds checking allows a write beyond the intended buffer. This memory corruption can crash the affected process and, depending on adjacent memory layout, may be leveraged as a primitive for further exploitation.

Because Apple uses common image frameworks across platforms, the same defect manifests on phones, tablets, desktops, TVs, and headsets. Any component that decodes user-supplied images through the vulnerable framework inherits the risk. This includes Messages, Mail, Safari, Preview, and third-party applications that rely on system image APIs.

Root Cause

The root cause is an out-of-bounds write [CWE-787] in an image decoding routine. Missing or incorrect validation of image metadata or pixel data allows the parser to compute an offset or length that exceeds the destination buffer. Apple's fix introduces improved bounds checking to reject or safely handle malformed inputs before the write occurs.

Attack Vector

Exploitation is network-reachable but requires user interaction. An attacker delivers a malicious image through email, messaging, a web page, or an attachment. When a victim previews or opens the image with a vulnerable version, the decoder triggers the out-of-bounds write. No authentication or elevated privileges are required on the target device.

No public proof-of-concept or in-the-wild exploitation has been reported for this CVE at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-65395

Indicators of Compromise

Unexpected crashes of image-handling processes such as MobileSafari, Messages, Mail, Preview, or QuickLook with signals consistent with memory corruption (SIGSEGV, SIGBUS).
Crash reports referencing image decoding frameworks (ImageIO, CoreGraphics) after opening attachments or previewing web content.
Delivery of unsolicited image files through iMessage, Mail, or messaging platforms shortly before device instability.

Detection Strategies

Collect and centralize macOS DiagnosticReports and iOS crash logs to identify repeated image-decoder faults across the fleet.
Inspect MDM-managed device inventories for OS builds older than iOS 26.7, iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, or visionOS 27.
Correlate email and messaging gateway logs for unusual image attachments with abnormal dimensions, malformed headers, or oversized metadata.

Monitoring Recommendations

Enable telemetry forwarding from Apple endpoints to a central logging platform for crash and process termination visibility.
Track patch compliance status through mobile device management (MDM) dashboards until 100% coverage across affected platforms.
Alert on repeated process crashes tied to a single user or a single inbound sender to surface targeted delivery attempts.

How to Mitigate CVE-2026-65395

Immediate Actions Required

Update all affected devices to iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, or visionOS 27 as applicable.
Prioritize devices that regularly receive external email, messaging, or web content from untrusted senders.
Enforce updates through MDM policies and verify build numbers post-deployment.

Patch Information

Apple has released fixes across its platform family. Refer to the vendor advisories for build-specific details: Apple Support Document #149034, Apple Support Document #149035, Apple Support Document #149036, Apple Support Document #149038, Apple Support Document #149041, Apple Support Document #149042, and Apple Support Document #149043.

Workarounds

Disable automatic image preview in Mail and messaging clients where feasible until patches are applied.
Restrict inbound attachments from untrusted senders at the email gateway and block risky image formats where possible.
Educate users to avoid opening unsolicited image attachments or previewing content from unknown web sources on unpatched devices.

bash

# Verify current OS build on macOS to confirm patch level
sw_vers

# Trigger a software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart