A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. A remote attacker may be able to cause unexpected system termination.
[POC] CVE-2026-65343 — CVE-2026-65343
CVE-2026-65343 PoC — AppleKeyStore OOB read → KASLR defeat (iOS 26.6 / 23G71)
[POC] CVE-2026-65343 — iOS26.6-CVE-2026-65343
CVE-2026-65343 PoC — AppleKeyStore OOB read → KASLR defeat (iOS 26.6 / 23G71)
PoC: CVE-2026-65343-e7eb2ed
CVE-2026-65343: OOB read in AppleKeyStore.kext (_LibSer_SEPControl_Deserialize) copies an ACM buffer to userspace without length validation, letting sandboxed processes leak kernel pointers (0xfffffff0…) and defeat KASLR via DYLD_INTERPOSE ACM handle capture. Fixed in iOS 26.6.1 (23G83).
PoC: iOS26.6-CVE-2026-65343
CVE-2026-65343 PoC — AppleKeyStore OOB read → KASLR defeat (iOS 26.6 / 23G71)
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free