Apple iOS CVE-2026-65395

Exploitation requires the victim to open or preview a maliciously crafted image file on an unpatched device (CVSS UI:R is the decisive limiter); the file can be delivered over the network through any channel that renders images - email attachment, messaging app, web page, or shared file - with no authentication required (PR:N) and no special network position (AV:N/AC:L). What limits real-world exploitation: attacker-controlled code execution is not established by the scoring, which credits only availability loss (C:N/I:N/A:H); no public exploit or PoC was identified in the supplied data; targets must still be running a version below the fixed releases; and on iOS/iPadOS and visionOS the sandbox and app-level isolation may contain a crash to the requesting process rather than the whole system. No specific non-default configuration, port, or enabled feature is documented as a prerequisite beyond the user opening the image, so exposure is broad across all affected builds that have not been updated.

The signals here point to a moderate, patchable issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) says the attacker can reach the target over the network without credentials or complexity, but must convince the victim to open a crafted image, and that the resulting impact is confined to availability - no confidentiality or integrity loss is credited, which argues against a code-execution-driven exfiltration scenario in the vendor's own scoring. EPSS is 0.18% (7th percentile), indicating very little observed exploitation pressure, and there is no CISA KEV listing, so active exploitation is not confirmed; no public exploit code was identified in the supplied data either. The description's phrase 'memory corruption' is broader than the A:H-only CVSS impact and could, in principle, be leveraged beyond a crash depending on the allocator state - that gap between the description and the CVSS impact metrics is the main uncertainty and should be treated as unconfirmed rather than assumed to be a full RCE primitive. Overall this is a routine update-and-move-on item for managed Apple fleets, but it is worth prioritizing on high-value devices where an image-based DoS on a mobile device could interrupt critical workflows.

An attacker embeds a specially crafted image in a message, email, or web page and waits for the victim to open or preview it; because the vector is AV:N/AC:L/PR:N/UI:R, no credentials or prior access are needed, only the user's action of viewing the file. When the affected decoder processes the file, the out-of-bounds write corrupts adjacent memory, causing the viewing app - or potentially the device's image stack - to crash or behave unpredictably. With no public exploit code identified, a real-world attacker would need to develop the trigger themselves, and the CVSS impact profile suggests disruption rather than a ready-made takeover chain.