CVE-2026-65398

Executive Summary

CVE-2026-65398 is a kernel-level out-of-bounds access vulnerability (CWE-120, improperly bounded memory operation) affecting Apple's core operating systems across iPhone, iPad, Mac, Apple TV, Vision Pro, and Apple Watch. A local application running with low privileges can trigger the flaw to corrupt kernel memory or cause unexpected system termination, yielding a CVSS v3.1 base score of 7.8 (High). The vulnerability is fixed in the 27-generation releases of all affected platforms; no public proof-of-concept, exploit code, or CISA KEV entry currently exists, and EPSS remains low at 0.00170 (6.6th percentile).

Technical Analysis

The NVD description states that the issue is an "out-of-bounds access issue" that was "addressed with improved bounds checking," fixed across six Apple operating system families in their 27-generation releases. The CWE classification is CWE-120 (Buffer Copy without Checking Size of Input — classical buffer overflow), indicating that a memory copy or indexing operation was permitted to read or write beyond the boundary of an allocated buffer because a length or offset value was not correctly validated before use.

Because the fix is described as "improved bounds checking," the root cause is a missing or insufficient validation of an attacker-influenced size, count, or index prior to a memory access. The affected component operates in kernel context — the description explicitly notes that exploitation may "corrupt kernel memory." This places the flaw in the kernel attack surface rather than in a user-space application sandbox, meaning a successful trigger can affect memory not assigned to the calling process.

Attack surface: the flaw is reachable by "an app," meaning the vulnerable kernel operation is exposed through a system call, driver interface, or kernel service that a normal installed application can invoke. No specific kernel subsystem, function name, or interface name is disclosed in the NVD description or CNA title, so the precise reachable entry point cannot be stated with confidence. The "improved bounds checking" wording is consistent with the common iOS/macOS pattern where a length field, element count, or copy size supplied by the caller is used in a memcpy-style operation or array index without a prior upper-bound comparison against the destination buffer size. The operation then either over-reads adjacent kernel memory (information disclosure path toward C:H) or over-writes it (integrity/crash path toward I:H / A:H), matching the CVSS confidentiality, integrity, and availability all-High subscores.

Critically, the AV:L (Local) and PR:L (Low Privileges) vector components confirm that this is not remotely triggerable and does not require administrative or root privileges to attempt — a standard sandboxed application is the assumed attacker position. UI:N (No User Interaction) indicates that exploitation on a targeted device can proceed without any confirmation prompt once the malicious app is running.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-65398. The attack chain below is therefore described at the vulnerability-class level (local out-of-bounds access in kernel context) and is inferred from the CWE-120 class plus the CVSS vector; it does not reference any specific function, interface, or file path because none are disclosed.

1. Reconnaissance / target identification. The attacker identifies a target running an affected OS version (pre-27 generations of iOS, iPadOS, macOS Golden Gate, tvOS, visionOS, or watchOS). Because this is a local vector, reconnaissance centers on delivery rather than network scanning — determining which users will install or run attacker-controlled software, and confirming the OS build is unpatched.

2. Trigger. The attacker delivers and gets a low-privileged app installed and executed on the target (side-loaded app, malicious App Store repackaging, or a legitimate app whose own input can be steered by an attacker). The app invokes the exposed kernel operation and supplies a crafted length, index, or count value that exceeds the validated bounds of the kernel-side buffer. Because the vulnerability requires only low privileges and no user interaction beyond app execution, the sandbox boundary is the primary obstacle.

3. Payload / execution. At the vulnerability-class level, the crafted parameter causes a memory access outside the intended buffer. In the write direction this is a kernel heap or buffer overflow; in the read direction it is an out-of-bounds read. Successful control of the overflowed region is the prerequisite for more advanced kernel exploitation (BROP/gadget-driven corruption is a generic next step, not a claim specific to this CVE).

4. Post-exploitation impact. The NVD description confirms two outcomes: "unexpected system termination" (kernel panic / denial of service) or "corrupt kernel memory" (a memory-corruption primitive). Corruption of kernel memory is a precursor to privilege escalation and sandbox escape; the CVSS vector's all-High CIA subscores reflect that reachable impact. Whether this CVE alone achieves kernel read/write or full code execution is not stated in the available data and should not be assumed without further research.

Impact Assessment

Business impact: compromise of an endpoint running an unpatched Apple OS can lead to kernel-memory corruption. On managed fleets (corporate iPhones, iPads, Macs, Apple TVs, and Vision Pro units), this translates to potential device instability (kernel panics disrupting productivity and kiosk/AV deployments) and, in the worst case, a local privilege-escalation primitive that undermines the platform's security model.

Affected systems: iPhone/iPad (iOS/iPadOS < 27), Mac (macOS Golden Gate < 27), Apple TV (tvOS < 27), Apple Vision Pro (visionOS < 27), and Apple Watch (watchOS < 27).

Blast radius: local to each device. The AV:L metric means the flaw cannot be reached over the network by itself; an attacker must already have code execution as a low-privileged app on the device. PR:L means no elevated privilege is needed to attempt the trigger.

CVSS breakdown (per vector):

• AV:L — Local: requires local code execution context on the device.
• AC:L — Low: no special conditions; the vulnerable path is reachable under normal conditions.
• PR:L — Low: a standard app suffices; no root/admin needed.
• UI:N — None: no user confirmation required once the app runs.
• S:U — Unchanged: the exploit's authority does not formally cross a defined security scope in the CVSS model (though kernel memory corruption in practice is a serious sandbox-relevant primitive).
• C:H / I:H / A:H — High: potential full loss of confidentiality, integrity, and availability of the affected component.

Exploitability today is low: EPSS 0.00170 (6.6th percentile), no KEV listing, no known public exploit, and no observed in-the-wild campaigns in the provided data. The 7.8 score reflects the severity if exploited, not current exploit activity.

Detection Guidance

Sigma Rule

title: Apple Kernel Out-of-Bounds Access Attempt - Suspicious App Crash Pattern (CVE-2026-65398)
id: 3f7b2c9e-1a44-4d8e-9b21-7c0d5e6a9f10
status: experimental
description: Detects anomalous application-triggered kernel crash or panic patterns consistent with local kernel memory corruption attempts against unpatched Apple OS (pre-27 generations). Correlates app crashes with kernel panic reports.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65398
author: Valters IT Threat Intelligence
date: 2026-01-01
tags:
  - attack.t1068
  - attack.t1203
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_panic:
    event.action|contains:
      - 'kernel_panic'
      - 'panic'
    event.category: 'process'
  selection_crash:
    event.action|contains: 'crash'
    process.executable|endswith: '.app/Contents/MacOS'
  condition: selection_panic or selection_crash
falsepositives:
  - Legitimate applications crashing due to unrelated bugs
  - Developers debugging kernel extensions
level: medium

YARA Rule

rule CVE_2026_65398_Kernel_OOB_App_Indicator
{
    meta:
        description = "Heuristic detection for app binaries that embed crafted out-of-bounds length values targeting Apple kernel memory operations (CVE-2026-65398). Behavioral detection is required; this is a supporting heuristic only."
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65398"
        date = "2026-01-01"
        severity = "high"
        cwe = "CWE-120"
    strings:
        $macho64 = { CF FA ED FE }
        $macos_target = "macOS" ascii wide nocase
        $ios_target = "iOS" ascii wide nocase
        $oob_hint = { 48 8B 44 24 ?? 48 89 44 24 ?? }  // generic stack load/store, reference only
    condition:
        $macho64 at 0 and ($macos_target or $ios_target)
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-65398 Apple Kernel Out-of-Bounds Access - Post-Exploitation Kernel Panic/Corruption Indicator (local)"; flow:to_server; content:"kernel"; nocase; content:"panic"; nocase; classtype:attempted-admin; reference:cve,2026-65398; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-65398; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:202665398; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.executable : ("*.app/Contents/MacOS/*") and
  process.executable : ("/System/Library/*", "/usr/libexec/*") and
  process.args : ("*crash*", "*panic*", "*corrupt*")

Supporting correlation for crash reporters:

event where event.category == "process" and
  event.action : ("kernel_panic", "crash") and
  process.name : ("ReportCrash", "panic")

Splunk SPL Query

index=os_apple (sourcetype=macos_unified_log OR sourcetype=osquery OR sourcetype=jamf)
| search ("kernel_panic" OR "panic" OR "memory corruption" OR "out of bounds")
| rex field=message "(?<crashapp>[\w\.\-]+\.app)"
| stats count min(_time) as first_seen max(_time) as last_seen values(crashapp) as apps by host, process_name
| where count > 1
| convert ctime(first_seen) ctime(last_seen)
| table host process_name apps count first_seen last_seen

Wazuh OSSEC Rule

<group name="apple,kernel,cve-2026-65398,">
  <rule id="100621" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.action">kernel_panic</field>
    <description>CVE-2026-65398: Apple OS kernel panic detected - possible out-of-bounds kernel memory corruption attempt</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
  <rule id="100622" level="8">
    <decoded_as>json</decoded_as>
    <field name="event.action">crash</field>
    <description>Application crash on Apple OS that may correlate with kernel memory corruption activity (CVE-2026-65398)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4: CLAIMED — the fix is asserted by a single source (NVD) and has not been independently confirmed.

1. Immediate mitigations (if patching cannot be performed at once):

   • Restrict installation of untrusted or side-loaded applications on managed Apple devices via MDM allowlisting (this is a local-vector flaw; preventing untrusted code execution is the only effective control short of patching).
   • Enforce app notarization and keep Gatekeeper / app sideloading restrictions enabled on macOS and iOS/iPadOS.
   • Monitor crash reporters and kernel panic logs for anomalies (see Detection Guidance) as an early-warning indicator.
   • Isolate high-value devices (executive, administrative, developer Macs) and limit their ability to install third-party apps.

2. Patch / upgrade steps:

   • Upgrade to iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, or watchOS 27 on all affected devices as these versions are listed by NVD as containing the fix.
   • Use centralized MDM (Jamf, Intune, Kandji, Mosyle) to push OS updates and confirm compliance reporting.
   • Verify all Apple TV, Apple Watch, and Vision Pro units are updated, as these are frequently overlooked during patch cycles.

3. Long-term hardening:

   • Maintain a disciplined patch cadence for all six Apple OS families, not just macOS/iOS.
   • Keep threat modeling current for the local attack surface — sandboxed apps remain a realistic initial-access vector.
   • Enable endpoint telemetry on managed Apple devices (Unified Logging, Endpoint Security framework, or an EDR sensor) to gain visibility into kernel-level anomalies.

References

• NVD — CVE-2026-65398: https://nvd.nist.gov/vuln/detail/CVE-2026-65398
• CWE-120 — Buffer Copy without Checking Size of Input: https://cwe.mitre.org/data/definitions/120.html
• Apple Security Releases (vendor advisory home): https://support.apple.com/en-us/100100
• FIRST EPSS (score 0.00170; 6.6th percentile): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (no KEV listing for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / campaign note: No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or CISA KEV entry are currently associated with CVE-2026-65398 based on the provided intelligence. EPSS is low (0.00170, 6.6th percentile), and the flaw's local-only vector limits mass exploitation. This assessment should be revisited if Apple publishes a formal security advisory or if exploit activity emerges.