Out-of-bounds write in macOS - CVE-2026-65395
Published: September 15, 2026
Vulnerability identifier: #VU149780
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-65395
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to write data outside of intended memory bounds.
The vulnerability exists due to an out-of-bounds write in ImageIO when processing input. A remote attacker can send specially crafted input to the affected component to write data outside of intended memory bounds.
Affected software
macOS
Apple iOS
iPadOS
tvOS
visionOS
Apple iOS
iPadOS
tvOS
visionOS
How to mitigate CVE-2026-65395
Install update from vendor's website.
macOS - addressed in versions 26.7 25G229, 15.8 24H23, 27.0 26A428
Apple iOS - addressed in versions 26.7 23H24, 27.0 24A427, 27.0 24A437
iPadOS - addressed in versions 26.7 23H24, 27.0 24A437
tvOS - update to 27.0 24J361
visionOS - update to 27.0
Apple iOS - addressed in versions 26.7 23H24, 27.0 24A427, 27.0 24A437
iPadOS - addressed in versions 26.7 23H24, 27.0 24A437
tvOS - update to 27.0 24J361
visionOS - update to 27.0
External References
Related Security Bulletins
- Multiple vulnerabilities in macOS Tahoe
- Multiple vulnerabilities in macOS Sequoia
- Multiple vulnerabilities in macOS
- Multiple vulnerabilities in Apple iOS 26 and iPadOS 26
- Multiple vulnerabilities in Apple iOS 27 and iPadOS 27
- Multiple vulnerabilities in Apple visionOS
- Multiple vulnerabilities in Apple tvOS