Vulnerability record · CVE-2016-4655 · published 25 August 2016
CVE-2016-4655: Apple iOS kernel memory information disclosure via crafted app
Apple · Iphone Os
The iOS kernel before 9.3.5 fails to properly initialize or restrict access to memory, allowing a crafted app to read sensitive data from kernel memory. Because this is a kernel-level information leak, the exposed data can include pointers and other values useful for defeating mitigations in a larger exploit chain. The record does not specify the exact vulnerable function or the nature of the leaked data.
Description
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Automated analysis
high priorityThe flaw is confirmed exploited in the wild and listed in CISA KEV, but it requires local app installation and yields only information disclosure, not direct code execution.
What it is
The iOS kernel before 9.3.5 fails to properly initialize or restrict access to memory, allowing a crafted app to read sensitive data from kernel memory. Because this is a kernel-level information leak, the exposed data can include pointers and other values useful for defeating mitigations in a larger exploit chain. The record does not specify the exact vulnerable function or the nature of the leaked data.
Impact
An attacker who can run a crafted app on the device gains read access to kernel memory contents, which can reveal sensitive information and aid further exploitation. There is no evidence in this record of code execution, modification of data, or denial of service from this flaw alone.
Attack surface
The vector is local (AV:L) with no privileges required (PR:N) but user interaction required (UI:R), meaning the attacker must get the victim to install or open a crafted app. No network or remote unauthenticated path is described in this record.
Exploitation
The vulnerability is listed in CISA KEV (added 2022-05-24), and EPSS gives a 30-day probability of 0.33353 (98.3rd percentile), indicating observed exploitation activity. An Exploit-DB entry is referenced, and public reporting links this flaw to the Trident/Pegasus exploit chain, though the record does not detail the exploit itself.
What to do
- Update iOS to 9.3.5 or later per Apple advisories HT207107 and HT207145; this is the primary fix.
- Enforce a minimum supported iOS version on managed devices and block or restrict installation of apps from untrusted sources.
- Apply mobile device management policies that prevent sideloading and limit enterprise app distribution to trusted, signed applications.
- Monitor for and remove devices running unsupported iOS versions that cannot receive the patch.
Detection
- Inventory iOS device versions and flag any device below 9.3.5 as exposed.
- Monitor MDM or EMM logs for installation of sideloaded, enterprise-signed, or otherwise untrusted apps.
- Correlate endpoint or network telemetry for known Pegasus/Trident indicators if available, recognizing this record does not supply specific IOCs.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2016-4655 to the Known Exploited Vulnerabilities catalog on 24 May 2022 as "Apple iOS Information Disclosure Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 14 June 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2016-4655 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-4655), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
