CVE-2026-65395

Undergoing Analysis Undergoing Analysis - In Progress

Out-of-Bounds Write in Apple iOS and macOS

Publication date: 2026-09-14

Last updated on: 2026-09-15

Assigner: Apple Inc.

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted image may result in memory corruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-15

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-03

NVD

CVE-2026-65395

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ios	26.7
apple	ipados	26.7
apple	ios	27
apple	ipados	27
apple	macos_golden_gate	27
apple	macos_sequoia	15.8
apple	macos_tahoe	26.7
apple	tvos	27
apple	visionos	27

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is an out-of-bounds write vulnerability caused by insufficient bounds checking when processing images. A maliciously crafted image could trigger memory corruption by writing data outside the intended memory area.

Detection Guidance

This vulnerability is specific to Apple operating systems and relates to image processing. Detection requires checking if your device is running a vulnerable version of iOS, iPadOS, macOS, tvOS, or visionOS. Use system update commands to verify your current OS version against the fixed versions listed in the CVE description.

Impact Analysis

If exploited, this flaw may allow attackers to execute arbitrary code or crash applications by corrupting memory. Users could experience crashes, data corruption, or potential unauthorized access to sensitive information.

Compliance Impact

The vulnerability involves memory corruption due to an out-of-bounds write issue when processing maliciously crafted images. This could potentially lead to unauthorized data access or manipulation, which may impact compliance with GDPR (data protection) or HIPAA (health data security) if exploited. However, specific compliance impacts are not detailed in the provided context.

Mitigation Strategies

Update affected Apple devices to the latest versions: iOS 26.7 or later, iPadOS 26.7 or later, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, or visionOS 27. This vulnerability is fixed in these versions.

Hi! I’m here to help you understand CVE-2026-65395. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70