Preface: CVE-2026-65349 is a vulnerability located inside the XNU kernel. Although it is often triggered by attackers using WebKit as a springboard, its fundamental flaw lies in the lack of strict boundary checks when the kernel parses input parameters from user space (through calls like ioctl/IOKit), leading to out-of-bounds reads of kernel memory.
Background: After the WebKit web engine is compromised, malicious code resides in User Space and then transmits an abnormally large data_length structure to the kernel via an ioctl pipe.
The kernel driver lacks validation of the memcpy source boundary, causing sensitive data within the kernel (such as tokens from other apps and system keys) to be packaged and copied back to User Space, resulting in information disclosure or system panic.
This is not the only way, but it is a conceptual approach that follows the theory.
Ref: The underlying logic that triggered the vulnerability:
Insufficient input validation – Apple officially stated that this vulnerability was fixed through “Improved input validation”.
IOKit’s method – Malicious programs (or hijacked WebKit processes) can use the IOKit client interface to pass a deliberately constructed structured input to the kernel driver.
Memory out of bounds – When the kernel driver processes this ioctl-like request, it does not strictly check the “length/size” parameter passed in by the user, causing the kernel pointer to directly read the kernel privacy memory outside the boundary (out-of-bounds read), which in turn leads to data leakage or system panic and crash.
Vulnerability details: An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to cause unexpected system termination or read kernel memory.
Ref: Compromised WebKit processes can exploit this flaw to read sensitive adjacent kernel memory, potentially leading to information disclosure or system panics.
Official announcement: Please refer to the link for details – https://nvd.nist.gov/vuln/detail/cve-2026-65349