CVE-2026-65330
MEDIUM 6.5 ALL-YEARSThe issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.5%chance of exploitation in 30 days · 39th percentile
Impact if exploited
6.5CVSS 3.1 · MEDIUM · ADP
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ⚠User interaction: A user must take an action (click / open a file)
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References and research data (JSON)
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
2 candidates
- https://github.com/ByteV0rtex/CVE-2026-65330
CVE-2026-65330 PoC — setxattr PAC bypass via fixed #0x307a diversifier (iOS 26.6 / 23G71)
PoC-in-GitHub · CVE-2026-65330
PoC-in-GitHub · CVE-2026-65330 · Updated 2026-10-22T02:02:15Z - https://github.com/csrXamfi/CVE-2026-65330
My first CVE
PoC-in-GitHub · CVE-2026-65330
PoC-in-GitHub · CVE-2026-65330 · Updated 2026-09-16T11:39:57Z
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Apple | Ipados | < 26.6.1 |
| Apple | Iphone Os | < 26.6.1 |
| Apple | Macos | ≥ 26.0 and < 26.6.2 |
All CVSS metrics
- MEDIUM 6.5 v3.1 · ADP Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - MEDIUM 6.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
Advisories
- https://support.apple.com/en-us/148281 CVE record · apple · Updated 2026-10-20T00:50:13.898Z
NVD · CVE-2026-65330 · Updated 2026-09-14T21:17:17.003 - https://support.apple.com/en-us/148282 CVE record · apple · Updated 2026-10-20T00:50:13.898Z
NVD · CVE-2026-65330 · Updated 2026-09-14T21:17:17.003 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60504 EUVD · EUVD-2026-60504
Technical & other
- https://support.apple.com/en-us/149036CVE record · apple · Updated 2026-10-20T00:50:13.898Z
NVD · CVE-2026-65330 · Updated 2026-09-14T21:17:17.003 - https://support.apple.com/en-us/149037CVE record · apple · Updated 2026-10-20T00:50:13.898Z
NVD · CVE-2026-65330 · Updated 2026-09-14T21:17:17.003 - https://support.apple.com/en-us/149038CVE record · apple · Updated 2026-10-20T00:50:13.898Z
NVD · CVE-2026-65330 · Updated 2026-09-14T21:17:17.003 - https://support.apple.com/en-us/149043CVE record · apple · Updated 2026-10-20T00:50:13.898Z
NVD · CVE-2026-65330 · Updated 2026-09-14T21:17:17.003
Sources: NVD · CVE.org · All sources and attribution · EPSS