EUVD-2026-77888
GHSA-p2xh-3rv8-rr7c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker distributes malicious app
-
DeliveryVictim installs and runs app
-
ExploitApp triggers out-of-bounds access
-
ExecutionCorrupt kernel memory or crash system
-
ImpactKernel-level compromise / DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to get code running as an app on the device (PR:L, AV:L) - e.g. a malicious, sideloaded, enterprise-provisioned, or trojanized application; there is no remote or unauthenticated network path. No user interaction beyond running the app is needed (UI:N). Exploitation is limited to devices running affected pre-27 releases of iOS/iPadOS, macOS, tvOS, visionOS, or watchOS; installing the 27-series updates fully remediates it. The realistic ceiling is a device crash unless combined with further exploitation to weaponize the kernel memory corruption. |
| Impact | All signals point to a genuine but not urgent local-privilege/kernel-integrity issue rather than an internet-facing emergency. The CVSS 3.1 vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is internally consistent with the description: a locally-installed app (PR:L) with no user interaction can trigger an out-of-bounds access to crash the device or corrupt kernel memory, yielding high confidentiality/integrity/availability impact within an unchanged scope. Exploitation-probability signals are LOW and mutually consistent: EPSS is 0.17% (7th percentile), there is no CISA KEV listing (confirmed actively exploited: NO), and no public exploit code was identified. There is no SSVC record in the input to cite. The one nuance worth flagging: because the corruption is in kernel memory reachable from an app, real-world danger lies in chaining this as a sandbox-escape/privilege-escalation primitive (a common role for Apple kernel bugs in exploit chains), not in standalone drive-by risk. No signals conflict, but note the vuln was self-reported by Apple with no independent technical write-up, so the exploitability beyond a crash (i.e., reliable code execution) is vendor-asserted rather than demonstrated. Priority: patch on normal cadence; elevate for high-value/targeted-threat-model devices given the kernel-corruption impact. |
| Exploit ScenarioDerived | A user installs a malicious or compromised app from a sideload/enterprise channel or a trojanized App Store submission. When run, the app issues crafted input that triggers the out-of-bounds access, either crashing the device (unexpected system termination) or corrupting kernel memory to attempt privilege escalation. No public exploit code exists, and success beyond a crash would require chaining with additional primitives. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
An out-of-bounds memory access in the Apple kernel allows a locally installed app to crash the system or corrupt kernel memory on iOS/iPadOS, macOS, tvOS, visionOS, and watchOS releases prior to the 27-series. The flaw is reachable only by an attacker who already has code executing as an app on the device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), for example a malicious, sideloaded, enterprise-provisioned, or trojanized application - there is no remote or unauthenticated network path, and no user interaction beyond launching the app is required. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.17% (7th percentile), and the realistic ceiling absent a follow-on kernel exploit chain is a device crash. Vendor patches are available in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
RemediationAI
Vendor-released patch: upgrade to iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, or watchOS 27 as applicable - installing the 27-series update fully remediates CVE-2026-65398 and should be prioritized for high-value or high-risk devices, and deployed fleet-wide via MDM/automated update enforcement. Per-platform installation details are in Apple's advisories at https://support.apple.com/en-us/149034 through https://support.apple.com/en-us/149038. Where immediate upgrading is not possible, compensating controls should focus on the delivery vector, since the flaw requires a locally installed app: enforce MDM allowlisting or App Store-only installation policies and restrict or disable sideloading, enterprise provisioning profiles, and developer-mode installation (trade-off: reduces flexibility for legitimate internal app distribution and can break line-of-business tooling); remove or restrict untrusted enterprise certificates and monitor for newly installed or re-signed applications (trade-off: high operational overhead and potential false positives). These controls only reduce the chance of the malicious-app prerequisite being met and do not eliminate the underlying kernel memory bug, so patch deployment remains the required fix; note that no vendor workaround short of upgrading is documented for the kernel issue itself. No KEV listing and a low EPSS of 0.17% (7th percentile) indicate this is not currently being exploited at scale, so remediation can be scheduled with standard patch-cycle urgency rather than emergency response, though the 7.8 severity and local kernel impact justify treating it as a priority item on any device holding sensitive data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an out-of-bounds access (CWE-120, classic buffer overflow / unchecked copy) that Apple addressed by adding improved bounds checking in the affected kernel component. CWE-120 describes memory operations that read or write past the end of a fixed-size buffer because the destination size is not validated against the source length; when this occurs in kernel context an attacker who can influence the data being copied can overwrite adjacent kernel structures, leading to memory corruption, privilege escalation primitives, or a panic/unexpected system termination. The AV:L/PR:L rating reflects that the corrupted code path is only reachable from a process already running with app-level privileges on the device - the attacker must first obtain the ability to execute code, typically through a malicious or repackaged application distributed via sideloading, enterprise provisioning profiles, or a compromised App Store binary. CPE data confirms the affected platform families as apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, and apple:watchos, all at versions below 27; because the same kernel/XNU-derived memory-handling code is shared across Apple's OS family, a single bounds-checking fix was propagated to all five product lines in the same release cycle. Exploitation cannot be triggered over the network and does not require the victim to interact beyond having the malicious app installed and running.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Reachable only from a locally-running app (AV:L, PR:L) with no interaction; out-of-bounds kernel memory corruption gives high C/I/A, and Apple/NVD convention treats it as S:U.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.
Executive ViewAI
Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected by a kernel memory corruption vulnerability (CVE-2026-65398) in pre-27-series releases, which allows a malicious app already installed on the device to crash the system or corrupt kernel memory, with no public exploit identified at time of analysis and no remote attack path. Leadership should prioritize patching because unpatched devices in the workforce could be destabilized by sideloaded or enterprise-provisioned apps, though the realistic impact without a follow-on exploit chain is limited to device crashes rather than widespread compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB