iOS and iPadOS CVE-2026-65349

Exploitation requires a malicious or attacker-controlled app to be installed and executed on the target device (local attack vector, AV:L; low privileges, PR:L per CVSS). Additionally, some form of user interaction is required to trigger the vulnerable code path (UI:R per CVSS vector) - the app cannot silently exploit the flaw without a user-initiated action. Exploitation is strictly local: no network-based or remote unauthenticated attack path exists. Limiting factors include: the target device must be running iOS/iPadOS prior to 26.6.1 or macOS Tahoe prior to 26.6.2; the attacker must achieve app execution on the device (e.g., via social engineering, enterprise certificate abuse, or App Store distribution); and the specific user interaction required is not elaborated in available documentation, representing an additional barrier to reliable exploitation.

The CVSS 3.1 score of 6.6 (Medium) with vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H reflects a constrained but meaningful attack surface: exploitation is local only, requires a low-privileged app context, and depends on some form of user interaction. The high confidentiality impact (C:H) from potential kernel memory reads is notable - kernel pointer leaks can serve as stepping stones for privilege escalation chains - but the integrity metric is N, ruling out direct write exploitation from this flaw alone. EPSS at 0.15% (5th percentile) corroborates the low immediate exploitation likelihood, and there is no CISA KEV entry or known public POC. The UI:R requirement is particularly limiting: it implies the malicious app cannot trigger the flaw autonomously without some user-driven event. Overall, this is a real but non-critical priority for most organizations - patch promptly as part of normal Apple update cycles, but this does not warrant emergency out-of-band response absent chaining evidence.

An attacker distributes a malicious app - potentially disguised as a legitimate utility - that, once installed and triggered via a user action (e.g., opening a file or performing an in-app operation), supplies crafted input to a vulnerable kernel-adjacent component. The out-of-bounds read either leaks kernel memory addresses useful for a follow-on privilege escalation exploit, or crashes the kernel entirely, causing a device reboot. No public POC has been identified at time of analysis, so this scenario is currently theoretical based on CVSS metadata.