CVE-2026-65367

Executive Summary

CVE-2026-65367 is a null pointer dereference vulnerability (CWE-476) in Apple iOS and iPadOS that allows a locally installed malicious application to cause unexpected system termination — effectively a kernel or system-level denial-of-service (DoS). The flaw is addressed through improved input validation in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, and iPadOS 26.5. The vulnerability carries a CVSS score of 5.5 (Medium severity) — given its local attack vector and high availability impact — and has no known public exploit code or evidence of exploitation in the wild as of this report. Patch confirmation is limited to a single source (NVD), and independent verification is recommended before enterprise deployment.

Technical Analysis

The vulnerability is a null pointer dereference (CWE-476) residing in an unspecified component of Apple's iOS and iPadOS operating systems. A null pointer dereference occurs when a program attempts to access memory at address zero (0x0000000000000000), typically because a function returns a null pointer that the caller fails to validate before dereferencing. In kernel-space systems like iOS/iPadOS, such an unchecked dereference triggers a page fault that cannot be handled gracefully, often resulting in a system panic and forced device reboot.

The NVD description indicates the root cause is insufficient input validation — the system component fails to properly validate certain input before using it to derive a pointer. Apple's fix introduces "improved input validation," suggesting the patch adds explicit null checks or validates the input data before pointer arithmetic is performed.

Key technical characteristics derived from the description and metadata:

• Attack Vector: Local (AV:L) — the attacker requires local access, specifically the ability to execute code (e.g., a malicious app installed via App Store, TestFlight, or sideloading).
• Privileges Required: Low (PR:L) — the attacker needs only standard user-level app privileges, not root/jailbreak access.
• User Interaction: None (UI:N) — no user interaction is required beyond installing and launching the malicious app.
• Impact: Complete denial-of-service (Availability: High) — the system terminates unexpectedly (kernel panic / forced reboot). No confidentiality (C:N) or integrity (I:N) impact.

The specific affected component, function names, or API endpoints are not disclosed in the NVD description. The affected version range is:

• iOS versions prior to 18.7.9 (i.e., < 18.7.9)
• iPadOS versions prior to 18.7.9
• iOS versions prior to 26.5
• iPadOS versions prior to 26.5

Note: The affected versions list in the metadata table is marked empty; the patch references indicate the fixed versions listed above. It is plausible that the vulnerability affects all versions prior to the two fix releases (18.7.9 and 26.5), but the exact vulnerable range is not explicitly stated in available data.

Attack surface: The most plausible attack surface is an application invoking a system service or framework API that accepts untrusted input (e.g., a file path, a crafted image, a malformed document, or a network response processed locally). The lack of input validation causes the underlying system component to produce a null pointer, which is then dereferenced without a check, crashing the system process or the kernel.

Insufficient technical detail is available to identify the specific component or code path. Attack analysis below is therefore described at the vulnerability-class level.

Exploitation Scenarios

Prerequisites:

• Attacker must be able to install and run a malicious application on a target iOS/iPadOS device.
• No jailbreak or elevated privileges required (PR:L).
• No user interaction beyond the initial app launch/execution.

Attack Chain (inferred from vulnerability class; no public PoC available):

1. Reconnaissance / Target Identification: The attacker identifies a target device running a vulnerable iOS/iPadOS version. This can be determined via User-Agent strings in web traffic, device management profiles (MDM), or social engineering to get the victim to check their Settings → General → About → iOS Version. The attacker crafts or repurposes a mobile application that carries the triggering logic.

2. Trigger Mechanism: The malicious app invokes the vulnerable system API or component with a crafted input. Given the "improved input validation" fix, the input likely lacks certain expected fields — e.g., a nil dictionary value, an empty array, a malformed property list, or a truncated data blob. Because the component fails to validate this input, an internal function returns a null pointer instead of a valid object reference.

3. Payload / Execution: The app calls the vulnerable function, which dereferences the null pointer without a null-check guard. On iOS/iPadOS, this causes a kernel-level page fault. Since the dereference occurs in a privileged system process (e.g., backboardd, SpringBoard, or a kernel extension), the fault cannot be recovered and triggers a kernel panic, resulting in immediate system termination and forced reboot.

4. Post-Exploitation Impact: The device becomes temporarily unavailable — the user experiences a sudden shutdown/restart loop if the app is set to re-launch automatically. Repeated launches of the malicious app can cause persistent denial-of-service. No data theft, code execution, or privilege escalation is possible with this specific CVE; impact is strictly availability. The attacker could use this as a nuisance attack (bricking a device in a kiosk mode) or as a distraction technique to coincide with other social engineering.

In-the-wild status: No public PoC, exploit code, or reports of active exploitation exist as of this writing. The EPSS score of 0.00098 (0.8th percentile) reinforces that exploitation likelihood is minimal in the near term.

Impact Assessment

CVSS Analysis (Base Score: 5.5, Medium):

• Attack Vector: Local (AV:L) — limits exploitation to devices with a malicious app installed.
• Attack Complexity: Low (AC:L) — no special conditions or race windows needed.
• Privileges Required: Low (PR:L) — standard app sandbox privileges suffice.
• User Interaction: None (UI:N) — fully automated once the app runs.
• Confidentiality Impact: None (C:N) — no data exposure.
• Integrity Impact: None (I:N) — no data modification.
• Availability Impact: High (A:H) — complete system termination.

Business Impact:

• Consumer Devices: Users experience unexpected reboots; repeated exploitation renders devices unusable until the app is removed.
• Enterprise Deployments: For organizations managing iOS/iPadOS fleets (e.g., via Apple Business Manager/MDM), a malicious app distributed through internal channels or a compromised developer account could cause mass device outages. Kiosk devices, point-of-sale terminals, and field tablets are particularly susceptible because they are unattended.
• Operational Downtime: Each forced reboot causes ~1–3 minutes of device unavailability. In critical workflows (e.g., healthcare, logistics scanning), this degrades operational efficiency.
• Reputational Risk: For enterprise apps, a crash loop tied to a third-party library could be misattributed, damaging vendor trust.

Blast Radius: Limited by the local attack vector — only devices with the malicious app installed are affected. No network propagation is possible. The lack of integrity/confidentiality impact means this is not a data breach vector; however, in combination with other vulnerabilities, it could serve as a persistence mechanism (e.g., preventing the user from applying security updates by repeatedly crashing the device).

Detection Guidance

Detection of this vulnerability is inherently difficult because the trigger is a local app invoking a system API with malformed input. There is no network signature. Detection must focus on:

1. Endpoint behavior: unexpected kernel panics, rapid reboot cycles, SpringBoard/backboardd crashes.
2. Application audit: identifying installed apps that invoke vulnerable APIs with malformed data patterns in logs.
3. Supply chain: monitoring for malicious app distribution channels.

Sigma Rule

Sigma rules are platform-agnostic and typically target Windows/Linux event logs. For iOS, there is no equivalent native log pipeline in most SIEMs. However, if MDM/JAMF telemetry or device sysdiagnose logs are ingested, the following rule can detect indicators of repetitive kernel panics:

title: iOS Kernel Panic Flood - CVE-2026-65367 Indicator
id: 5d2f8e4c-9a1b-4c3e-8f7a-2b6d1e5a9c04
status: experimental
description: Detects repetitive kernel panics on iOS/iPadOS devices, potential indicator of CVE-2026-65367 null pointer dereference exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65367
author: valtersit.com Threat Intel
date: 2026/07/01
logsource:
    product: generic
    service: device_telemetry
detection:
    selection:
        event_type: "kernel_panic"
        device_os: ["iOS", "iPadOS"]
    timeframe: 10m
    condition: selection | count() by device_id > 3
level: high
falsepositives:
    - Hardware failures causing random panics
    - Jailbreak instability

YARA Rule

YARA is best suited for scanning app binaries for suspicious patterns. Since no specific function names are known, the rule targets heuristic indicators — references to null-pointer patterns and crash-report generation hooks:

rule CVE_2026_65367_iOS_NullPtrDeref
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Heuristic detection of iOS app binaries attempting to trigger null pointer dereference (CVE-2026-65367)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65367"
        date = "2026-07-01"
        score = 60
    strings:
        $s1 = "exception" ascii wide nocase
        $s2 = "SIGSEGV" ascii wide nocase
        $s3 = "0x0" ascii wide
        $s4 = "null" ascii wide nocase
        $s5 = "reportCrash" ascii wide nocase
        $s6 = "panic" ascii wide nocase
    condition:
        (uint16(0) == 0xCIFA or uint32(0) == 0xFEEDFACE or uint32(0) == 0xCAFEBABE) // Mach-O binary
        and 3 of ($s*)
}

Suricata IDS Rule

This is a local vulnerability with no network trigger. However, if an attacker distributes the malicious app via web download, network detection of the app binary transfer may be relevant:

alert http any any -> any any (msg:"CVE-2026-65367 - Potential Malicious iOS App Distribution (.ipa download)";
    flow:established,to_client;
    http.header_names;
    content:"Content-Type|3a| application/octet-stream";
    http.uri;
    content:".ipa";
    pcre:"/[A-Za-z0-9]{8,}\.ipa$/";
    classtype:attempted-dos;
    sid:10065367;
    rev:1;
    metadata:created_at 2026_07_01, updated_at 2026_07_01, cve CVE-2026-65367;)

Elastic Detection

EQL rule to detect repeated crash events on the same device within a short window (requires device telemetry ingested into Elastic):

sequence by device.id with maxspan=10m
  [ event.category : "process" and process.name : "SpringBoard" and event.action : "crash" ]
  [ event.category : "process" and process.name : "kernel" and event.action : "panic" ]
  | stats count = count() by host.id

Splunk SPL Query

For Splunk environments ingesting MDM sysdiagnose or Jamf Pro logs:

index=mdm sourcetype=jamf:device:crash
| where like(message, "%kernel panic%") OR like(message, "%watchdog timeout%")
| eval device_id = coalesce(serial_number, udid)
| stats count by device_id
| where count >= 3
| table _time, device_id, count, message
| sort - count

Wazuh OSSEC Rule

Wazuh local file monitoring for panic/reboot logs on a macOS management host or Linux-based MDM server:

<group name="cve-2026-65367,">
    <rule id="100367" level="10">
        <decoded_as>json</decoded_as>
        <field name="device_type">iOS</field>
        <field name="event_type">kernel_panic</field>
        <description>iOS/iPadOS kernel panic detected - potential CVE-2026-65367 exploitation</description>
        <group>local_dos,</group>
        <mitre>
            <id>T1204</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED. The fix is claimed by a single source (NVD). Until Apple publishes an official security advisory and multiple independent sources confirm the patch, treat this as unverified for compliance purposes.

Immediate Mitigations (before patch verification):

1. Restrict app installation: Disable sideloading and TestFlight distributions for enterprise devices via MDM configuration profiles. Restrict App Store installations to approved internal catalog apps.
2. Application allowlisting: Use Apple's Managed App Distribution to maintain a strict allowlist of approved apps. Any app not in the list is blocked.
3. Monitor device health: Enable MDM-based crash reporting (e.g., Jamf Pro, Kandji) and set alerts for sudden reboot spikes — 3+ reboots per device per hour.
4. User awareness: Instruct users to report frequent unexpected reboots and to uninstall any recently added apps if such symptoms appear.

Patch/Upgrade Steps:

1. Verify patch authenticity: Monitor Apple Security Updates for the official advisory referencing CVE-2026-65367 and confirm the version numbers match (iOS 18.7.9 / iPadOS 18.7.9 / iOS 26.5 / iPadOS 26.5).
2. Stage the update in a pilot group (10–20 devices) for 48 hours to confirm no regressions.
3. Roll out via MDM: Push the OTA update to all managed devices. For supervised devices, use installEnterpriseApplication or MDM OSUpdate commands with a required install date.
4. For personal devices (BYOD), enforce a mandatory OS version via Conditional Access policies in your UEM.

Long-Term Hardening:

1. Enable automatic updates for supervised devices (MDM: SoftwareUpdateSettings → AutomaticUpdate set to true).
2. Adopt Apple's Zero-Day Notification program (if eligible) for early access to security details.
3. Require App Store only for all corporate devices; prohibit sideloading via configuration profile restrictions.
4. Review enterprise app code for any usage of low-level frameworks (e.g., CoreGraphics, ImageIO, or custom kernel extensions) that process untrusted input — these are prime candidates for null pointer dereference flaws.

References

1. NIST NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-65367
2. Apple Security Updates (verify after official advisory): https://support.apple.com/en-us/HT201222
3. CWE-476 — NULL Pointer Dereference (MITRE): https://cwe.mitre.org/data/definitions/476.html
4. CISA Known Exploited Vulnerabilities Catalog (NO entry for this CVE as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS — Exploit Prediction Scoring System (score: 0.00098): https://www.first.org/epss/

Exploit-in-the-Wild Evidence: None identified. No threat actor campaigns, ransomware operations, or APT groups have publicly associated with this CVE. The low EPSS score (0.8th percentile) and absence of any PoC reduce the immediate threat, but the ease of triggering a kernel panic makes this an attractive nuisance vector for unsophisticated actors.