CVE-2026-65343PoC(apple / ipados)

MEDIUMCVSS 7.5 · HIGH

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

Patch apple ipados systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. A remote attacker may be able to cause unexpected system termination.

apple CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-416

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ipados
iphone_os
macos

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
10 mentions across 7 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 4 signals
PoC mentioned or linked in 6 signals
Patch or workaround mentioned in 5 signals
Technical details provided in 9 signals
Disclosure: 3 classified signals
Peaked 6d ago at 3 mentions (2026-09-03); latest day: 2
10 total mentions across 7 days

Affected systems

Vendors

apple

Products

ipadosiphone_osmacos

Deep dive

Activity timeline10 mentions / 7d

Signal classification3 categories

PoC

660.0%

Disclosure

330.0%

Patch

110.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-03	3	PoC3
2026-09-04	1	PoC1
2026-09-09	1	PoC1
2026-09-15	1	Disclosure1
2026-09-21	1	Patch1
2026-09-22	1	PoC1
2026-09-23	2	Disclosure2

Full discourse10 posts

Rıdvan Yağlı@ridvanyagli45d
PoC
🔴 CVE-2026-65343 için iOS kernel PoC yayınlandı! AppleKeyStore kernel bileşenindeki bir Out-of-Bounds Read açığını hedefleyen PoC, sandbox içindeki ve özel entitlement gerektirmeyen bir uygulamadan kernel pointer'larını sızdırarak KASLR'ı aşmayı hedefliyor. Etkilenen: iOS/iPadOS 26.6 (23G71) ve öncesi Düzeltilen: iOS/iPadOS 26.6.1 (23G83) PoC, Secure Enclave üzerinden gerçek bir AppleKeyStore/ACM handle'ı yakalayıp hatalı declared_length değeriyle kernel heap verilerini okumaya ve kernel adreslerini tespit etmeye çalışıyor. ⚠️ Bu, tek başına tam RCE veya jailbreak PoC'si değil; ancak kernel exploit zincirinde KASLR bypass aşamasını gösteriyor. PoC: https://github.com/bytev0rtex/cve-2026-65343
Post summary
A proof‑of‑concept for CVE‑2026‑65343 targeting an OOB read in AppleKeyStore has been released with a public GitHub link. The vulnerability is fixed in iOS/iPadOS 26.6.1, but no active exploitation is reported.
125119610921.5K
2.4K followersView on X
ONE Jailbreak@onejailbreak_45d
PoC
📣CVE-2026-65343 PoC — AppleKeyStore OOB read → KASLR defeat (iOS 26.6 / 23G71) by @ByteV0rtex https://github.com/ByteV0rtex/CVE-2026-65343/
Post summary
A proof‑of‑concept for CVE-2026-65343 has been released by @ByteV0rtex, demonstrating an out‑of‑bounds read in AppleKeyStore that defeats KASLR on iOS 26.6 (23G71). The PoC is publicly available on GitHub.
73002128127.5K
34.3K followersView on X
Mr.Niko@_MrNiko26d
PoC
🚨 CVE-2026-65343 AppleKeyStore iOS 26.6. kernel pointer leak. KASLR slide. _LibSer_SEPControl_Deserialize copyout() trusts declared_length. no check against bytes left in the ACM buffer. 0x800 pulls ~0x7E8 past the message into adjacent kernel heap. pointers come back as 0xfffffff0xxxxxxxx. fixed in 26.6.1. on a real phone you still need a sandbox escape to reach AKS. the leak itself is the missing length check. credit: Drinor Selmanaj, Surya Narayan Kushwaha PoC: https://github.com/ByteV0rtex/CVE-2026-65343 #iOS #ExploitDev #InfoSec
Post summary
The tweet announces a kernel pointer leak in AppleKeyStore (CVE-2026-65343) with technical details and a linked PoC repository, while also noting it is fixed in iOS 26.6.1. Active exploitation is not claimed, and no named exploit tools are specified.
62201629012.4K
1.6K followersView on X
dbugs@ptdbugs45d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-65343 Vendor: Apple Product: iOS, iPadOS and macOS Tahoe Description: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. A remote attacker may be able to cause unexpected system termination. Link: https://github.com/bytev0rtex/cve-2026-65343 #dbugs_vuln
Post summary
A PoC/exploit for CVE‑2026‑65343 has been released, with Apple patching the use‑after‑free flaw in iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2.
01911317211.1K
3.7K followersView on X
Surya Kushwaha@suryaforr33d
Disclosure
@thedawgyg got 1k,1k,1k,1k for these cves wtf CVE-2026-84544,CVE-2026-84549,CVE-2026-65343,CVE-2026-86908
Post summary
The tweet announces four CVEs associated with $1,000 bug bounty payouts but provides no technical details, PoC, exploit, or remediation information beyond the CVE identifiers themselves.
1001031.1K
163 followersView on X
Ryx@PadhiyarRushi39d
PoC
Public PoC for CVE-2026-65343: AppleKeyStore OOB read. _LibSer_SEPControl_Deserialize takes a declared_length and copyout()s it without checking against remaining buffer size. Feed 0x800 → ~0x7E8 bytes of adjacent kernel heap land in userspace, including 0xfffffff0xxxxxxxx pointers. KASLR slide falls out. Needs AKS IOKit access (post-sandbox-escape / root / jailbreak). ✓ Fixed in 26.6.1. https://github.com/ByteV0rtex/CVE-2026-65343 #iOS #ReverseEngineering
Post summary
The post presents a public proof‑of‑concept for CVE‑2026‑65343, detailing an out‑of‑bounds read in AppleKeyStore with technical steps and a GitHub repository, while noting the issue has been patched in version 26.6.1.
11071599
953 followersView on X
habib@hbeeb200127d
Patch
CVE-2026-65343⁠ (AppleKeyStore OOB Read): تُستخدم لتجاوز حماية عناوين الذاكرة (KASLR Bypass). سبب حد هذا النطاق عند 26.6: أبل قامت بترقيع وإغلاق هذه الثغرات رسمياً في التحديث iOS 26.7؛ لذلك أي جهاز على إصدار 26.7 أو أعلى لا يستفيد من هذه المجموعة. يتبع ..
Post summary
The text focuses on CVE-2026-65343, an OOB read vulnerability in AppleKeyStore used for KASLR bypass, and emphasizes that Apple has patched it in iOS 26.7, so devices on this version or higher are not affected.
10010373
198 followersView on X
habib@hbeeb200125d
Disclosure
- ثغرة تسريب مؤشرات الذاكرة (⁠CVE-2026-65343⁠): المفهوم: الخلل في معالجة مصفوفة البيانات لمكون AppleKeyStore (AKS) يسمح بسحب عناوين متجاورة من ذاكرة النواة وتحديد مواقع خدمات النظام.
Post summary
Discloses CVE-2026-65343 as a kernel memory pointer leakage flaw in AppleKeyStore (AKS) but lacks exploit code, PoC, patch, or active exploitation claims.
1000084
197 followersView on X
UNDERCODE TESTING@UndercodeUpdate44d
PoC
🚨 AppleKeyStore KASLR Bypass (#CVE-2026-65343): Public PoC Unleashes Kernel Memory Disclosure on #iOS 2661 and Below + Video -Prediction: 📈 2 Positive | 📉 3 Negative https://undercodetesting.com/applekeystore-kaslr-bypass-cve-2026-65343-public-poc-unleashes-kernel-memory-disclosure-on-ios-2661-and-below-video/ Educational Purposes!
Post summary
A publicly available PoC for CVE-2026-65343 demonstrates a KASLR bypass that leaks kernel memory on iOS 26.61 and earlier; no patch, workaround, or active exploitation is reported.
00010115
724 followersView on X
habib@hbeeb200125d
Disclosure
*-بالنسبة للأجهزة الأحدث من معالج A14 فما فوق (مثل iPhone 12, 13, 14, 15, 16) تستفيد من ثغرات النواة الثلاث(⁠CVE-2026-84530⁠, ⁠CVE-2026-65343⁠, ⁠CVE-2026-64788⁠) وتفتقد لثغرة الإقلاع العتادية ⁠usbliter8⁠؛ النسبة المكتملة الأجهزة هو 55%، والنسبة المتبقية لها هي 45%
Post summary
The text discloses technical details regarding three kernel CVEs and a hardware boot vulnerability ('usbliter8'), specifying their applicability to Apple A14+ devices (iPhone 12-16) and providing compatibility percentages, likely in the context of jailbreak or security research.
0000090
197 followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	apple	ipados	-	-	-
OS	apple	iphone_os	-	-	-
OS	apple	macos	-	-	-

Explore more

Back to dashboard apple CVEs ipados vulnerabilities

What researchers are saying

CVE-2026-65343

Rıdvan Yağlı[verified]@ridvanyagliPoC

A proof‑of‑concept for CVE‑2026‑65343 targeting an OOB read in AppleKeyStore has been released with a public GitHub link. The vulnerability is fixed in iOS/iPadOS 26.6.1, but no active exploitation is reported.

Mr.Niko[verified]@_MrNikoPoC

The tweet announces a kernel pointer leak in AppleKeyStore (CVE-2026-65343) with technical details and a linked PoC repository, while also noting it is fixed in iOS 26.6.1. Active exploitation is not claimed, and no named exploit tools are specified.

dbugs[verified]@ptdbugsPoC

A PoC/exploit for CVE‑2026‑65343 has been released, with Apple patching the use‑after‑free flaw in iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2.

Ryx[verified]@PadhiyarRushiPoC

The post presents a public proof‑of‑concept for CVE‑2026‑65343, detailing an out‑of‑bounds read in AppleKeyStore with technical steps and a GitHub repository, while noting the issue has been patched in version 26.6.1.

ONE Jailbreak@onejailbreak_PoC

A proof‑of‑concept for CVE-2026-65343 has been released by @ByteV0rtex, demonstrating an out‑of‑bounds read in AppleKeyStore that defeats KASLR on iOS 26.6 (23G71). The PoC is publicly available on GitHub.

Surya Kushwaha@suryaforrDisclosure

The tweet announces four CVEs associated with $1,000 bug bounty payouts but provides no technical details, PoC, exploit, or remediation information beyond the CVE identifiers themselves.

habib@hbeeb2001Patch

The text focuses on CVE-2026-65343, an OOB read vulnerability in AppleKeyStore used for KASLR bypass, and emphasizes that Apple has patched it in iOS 26.7, so devices on this version or higher are not affected.

habib@hbeeb2001Disclosure

Discloses CVE-2026-65343 as a kernel memory pointer leakage flaw in AppleKeyStore (AKS) but lacks exploit code, PoC, patch, or active exploitation claims.