Executive brief
An out-of-bounds memory access vulnerability in iOS allows an app to corrupt kernel memory or cause the system to unexpectedly terminate. This could lead to system crashes, data corruption, or potentially serve as a foundation for privilege escalation attacks. The issue affects iPhone and iPad devices and is resolved in iOS 27 and iPadOS 27.
Technical details
This vulnerability is an out-of-bounds access issue in the iOS kernel that can be triggered by a malicious or compromised app. The root cause is insufficient bounds checking when processing untrusted input. An attacker with local code execution (ability to run an app on the device) can trigger out-of-bounds memory access, leading to kernel memory corruption or unexpected process termination. The vulnerability is resolved by improving bounds checking in the affected code path. No active exploitation in the wild has been reported at the time of disclosure.
Affected products
- Apple iOS prior to 27
- Apple iPadOS prior to 27
- Apple macOS Golden Gate prior to 27
- Apple tvOS prior to 27
- Apple visionOS prior to 27
- Apple watchOS prior to 27
Timeline
- 2026-09-14: disclosed: CVE-2026-65398 disclosed alongside iOS 27, iPadOS 27, macOS Golden Gate 27 releases
- 2026-09-14: patched: Patch available in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27