CVE-2026-65395

Executive Summary

CVE-2026-65395 is an out-of-bounds write (CWE-787) vulnerability affecting Apple's iOS, iPadOS, macOS, tvOS, and visionOS platforms. The flaw is triggered when processing a maliciously crafted image, resulting in memory corruption. With a CVSS score of 6.5, the vulnerability requires user interaction (opening a crafted image) but no privileges, and can lead to denial of service (availability impact). No public PoC or exploit code is currently available.

Technical Analysis

The vulnerability is an out-of-bounds write issue addressed with improved bounds checking. This class of vulnerability occurs when software writes data beyond the allocated memory buffer, often due to insufficient validation of input size or index values. In the context of image processing, the flaw likely resides in a routine that parses image metadata or pixel data. An attacker can craft a malicious image file that, when opened by a vulnerable application (e.g., Photos, Preview, Safari, or any app that renders images), triggers the out-of-bounds write. This can corrupt adjacent memory, potentially leading to a crash (DoS) or, in some cases, arbitrary code execution. The CVSS vector indicates network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and user interaction required (UI:R). The scope is unchanged (S:U), and there is a high impact on availability (A:H) but no impact on confidentiality or integrity. The vulnerability is fixed in multiple Apple OS updates.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description.

1. Reconnaissance/Target Identification: An attacker identifies a target running an affected Apple OS version (e.g., iOS < 26.7, macOS < 15.8). This could be done via network scanning (Shodan dorks for Apple devices) or social engineering.

2. Triggering the Flaw: The attacker crafts a malicious image file that exploits the out-of-bounds write. The exact technical details of the image format and parsing logic are not provided in the NVD description. The attacker must deliver this image to the victim and convince them to open it (e.g., via email, messaging app, or web download).

3. Payload/Execution Method: The malicious image is processed by a vulnerable application. The out-of-bounds write corrupts memory. Depending on the specific memory layout, this could cause a crash (denial of service) or potentially be leveraged for code execution if the write can be controlled to overwrite function pointers or return addresses. However, the CVSS score only indicates availability impact, suggesting that reliable code execution may not be achievable or is not the primary concern.

4. Post-Exploitation Impact: Successful exploitation results in memory corruption, likely causing the application to crash or the system to become unstable (DoS). The CVSS vector shows no confidentiality or integrity impact, so data theft or modification is not expected. The primary impact is disruption of service.

Impact Assessment

The vulnerability affects a wide range of Apple devices, including iPhones, iPads, Macs, Apple TVs, and Vision Pro. The blast radius is significant given the large installed base. The CVSS score of 6.5 (Medium) reflects the high availability impact (A:H) and the requirement for user interaction (UI:R). The lack of confidentiality and integrity impact (C:N/I:N) limits the severity. Business impact includes potential downtime, loss of productivity, and reputational damage if critical systems are affected. The EPSS score of 0.00352 (28.7th percentile) indicates a low probability of exploitation in the wild at this time. No CISA KEV listing, and no known threat actor campaigns.

Detection Guidance

Sigma Rule

title: Apple Image Processing Out-of-Bounds Write Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2026-65395 via crafted image files
author: Valters IT
date: 2026-01-01
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
      - '/Preview.app/Contents/MacOS/Preview'
      - '/Photos.app/Contents/MacOS/Photos'
    CommandLine|contains:
      - '.jpg'
      - '.png'
      - '.tiff'
      - '.heic'
  condition: selection
falsepositives:
  - Legitimate image opening
level: low

YARA Rule

rule CVE_2026_65395_Image_Exploit
{
    meta:
        description = "Detects malicious images attempting to exploit CVE-2026-65395"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65395"
        hash = "unknown"
    strings:
        $jpg_magic = { FF D8 FF }
        $png_magic = { 89 50 4E 47 0D 0A 1A 0A }
        $tiff_magic = { 49 49 2A 00 }
        $heic_magic = { 00 00 00 18 66 74 79 70 68 65 69 63 }
        $oom = { 00 00 00 00 00 00 00 00 }
    condition:
        (uint16(0) == 0xD8FF or uint32(0) == 0x474E5089 or uint32(0) == 0x002A4949 or uint32(0) == 0x68656963) and
        #oom > 10 and
        filesize < 10MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-65395 Apple Image Processing Out-of-Bounds Write Attempt"; flow:to_client,established; file_data; content:"|FF D8 FF|"; depth:3; content:"|89 50 4E 47|"; distance:0; within:4; pcre:"/(?:\xFF\xD8\xFF|\x89\x50\x4E\x47).{0,1000}(?:\x00{10,})/s"; metadata:service http; reference:cve,2026-65395; classtype:attempted-dos; sid:1000001; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("Preview", "Photos", "Safari", "QuickLook") and
  process.args : ("*.jpg", "*.png", "*.tiff", "*.heic") and
  process.parent.name in ("Mail", "Messages", "Safari")

Splunk SPL Query

index=main (sourcetype=macos:process OR sourcetype=windows:process)
(Image="*Preview*" OR Image="*Photos*" OR Image="*Safari*")
(CommandLine="*.jpg" OR CommandLine="*.png" OR CommandLine="*.tiff" OR CommandLine="*.heic")
| stats count by host, user, Image, CommandLine
| where count > 0

Wazuh OSSEC Rule

<group name="apple,cve-2026-65395,">
  <rule id="100001" level="5">
    <decoded_as>json</decoded_as>
    <field name="Image">\.(jpg|png|tiff|heic)$</field>
    <description>CVE-2026-65395: Potential image-based exploit attempt</description>
    <mitre>
      <id>T1204</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate Mitigations:

   • Avoid opening untrusted image files from unknown sources.
   • Disable automatic image preview in email clients and messaging apps.
   • Apply available OS updates as soon as possible.

2. Patch/Upgrade Steps:

   • Update to iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, or visionOS 27.
   • Verify patch installation via Apple's security update mechanism.

3. Long-term Hardening:

   • Implement memory-safe coding practices and rigorous bounds checking in image parsing libraries.
   • Use exploit mitigation technologies (e.g., ASLR, DEP) where available.
   • Conduct regular security audits of image processing components.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65395
• Apple Security Updates: https://support.apple.com/en-us/HT201222
• CWE-787: https://cwe.mitre.org/data/definitions/787.html
• EPSS: https://www.first.org/epss/
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.