Apple iOS CVE-2026-65359

Requires local access to an affected Apple device with the ability to execute code (a malicious or compromised app, or a logged-in local user) - reflected in AV:L and PR:L. There is no remote or network-triggerable path and no user-interaction requirement (UI:N). Exploitation works against default configurations of the affected OS versions (iOS/iPadOS before 26.7/27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, tvOS/visionOS/watchOS before 27); the limiting factor is that the attacker must already be running code locally, so this is a boundary/isolation bypass rather than an initial-access vector.

This is a genuinely higher-severity entry in Apple's multi-OS September 2026 patch wave, carrying a vendor CVSS 3.1 base of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) - notably above the 5.5 typical of the local-app info-disclosure CVEs in the same bulletins, because it combines kernel-memory disclosure (C:H) with the ability to crash the whole system (A:H). Exploitation is local: a user or app already running code on the device (PR:L) triggers an out-of-bounds read in kernel-adjacent code. EPSS is only 0.20% (10th percentile) and there is no public exploit identified at time of analysis, no CISA KEV listing, and no POC referenced - so despite the high CVSS this is not evidence of active or imminent widespread exploitation. The AV:L vector and PR:L requirement meaningfully limit real-world risk: an attacker must already have local code execution, which caps this as a privilege/information-boundary bypass rather than a remote entry point. Signals are internally consistent (local vector matches 'a local user' in the description); the main value here is a kernel read primitive useful for defeating KASLR or chaining with other bugs, not standalone remote compromise. Priority is moderate - patch in normal cycle unless the device is a high-value target where local code execution is plausible.

A malicious app installed on an iPhone, Mac, or Apple TV - or code a local user runs - invokes the affected kernel path with crafted input, triggering an out-of-bounds read that either leaks kernel memory (useful to break KASLR and stage a further exploit) or crashes the system. No public exploit or POC is known, and the attack requires local access with the ability to run code (PR:L), so it is not remotely reachable.