CVE-2026-65385
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, visionOS 27.2, watchOS 27.2. A buffer overflow may result in memory corruption and unexpected app termination.
Executive briefing
This record describes a reported software or hardware weakness. The description and CVSS rating are source metadata; practical risk depends on whether your environment uses an affected product/version and whether the vulnerable component is reachable and configured in an exploitable way.
Severity & exploitability
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Impacted products and platforms
Affected product configuration identifiers from NVD. Confirm exact versions and platform applicability against the vendor advisory.
| Product / CPE identifier | Version range | Vulnerable match |
|---|---|---|
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* | 26.7.2 | Yes |
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | 26.7.2 | Yes |
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* | 27.2 | Yes |
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* | 27.2 | Yes |
How it works and what it could affect
The NVD description is the authoritative short summary currently available for this record. A detailed technical mechanism is not inferred when the source record does not provide one.
Weakness classification: CWE-787
Review the CVSS attack characteristics above to understand whether exploitation is network/local, whether privileges or user interaction are required, and which confidentiality, integrity or availability impacts are scored.
Remediation and recommended response
- Identify exposure: compare the affected product and version ranges below with your asset inventory, software bill of materials, endpoint inventory and externally exposed services.
- Remediate: review the linked vendor security advisory or patch notes, upgrade to a fixed release, or apply the vendor-provided workaround if an upgrade cannot be completed.
- Mitigate while patching: restrict network access to the vulnerable service, disable the affected feature where operationally safe, and monitor vendor/CERT advisories for updated guidance.
- Validate: confirm the fixed version or mitigation on representative systems, run a vulnerability rescan, and retain change evidence.
Vendor remediation / security advisories
Exploit intelligence & references
No CISA KEV match is recorded in the latest successful catalog refresh. This is not a guarantee that public proof-of-concept code or exploitation does not exist.
- product-security@apple.com advisory
- product-security@apple.com advisory
- product-security@apple.com advisory
- product-security@apple.com advisory
Sources: NVD and CISA KEV when available. Vendor confirmation remains the final authority for fixed versions and workarounds.