CVE-2016-4656: Apple iOS kernel out-of-bounds write allows privileged code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityKernel-level code execution with confirmed in-the-wild exploitation (KEV) and a public exploit, though it requires local access and user interaction and affects only unpatched legacy iOS.

What it is

The iOS kernel before 9.3.5 contains an out-of-bounds write (CWE-787) that a crafted app can trigger to corrupt memory. Successful abuse yields arbitrary code execution in a privileged context, or a denial of service. Because the flaw sits in the kernel, it undermines the platform's core security boundary.

Impact

An attacker who lands the crafted app gains kernel-level code execution, effectively full control of the device, or can crash it. This is a privilege escalation from app context to the most privileged ring on the phone.

Attack surface

Reached locally: the vector is AV:L with PR:N and UI:R, so the attacker needs the victim to install or open a crafted app and interact with it, but no prior credentials. No network vector is described.

Exploitation

It is listed in CISA KEV (added 2022-05-24) and an Exploit-DB entry exists, so exploitation is confirmed in the wild; EPSS is 0.236 (97.7th percentile). No ransomware campaign use is recorded.

What to do

• Update iOS to 9.3.5 or later per Apple's advisory (HT207107); this is the only complete fix.
• Enforce a minimum supported iOS version and block or retire devices that cannot be patched.
• Restrict app installation to managed/trusted sources and review enterprise app catalogs for sideloaded builds.
• Where patching is impossible, isolate or replace the affected device rather than relying on compensating controls.

Detection

• Inventory iOS devices and flag any reporting a version below 9.3.5.
• Monitor MDM or EMM logs for installation of unexpected or sideloaded apps on managed devices.
• Watch for unexplained kernel panics, reboots or crashes that could indicate memory-corruption attempts.
• Hunt for post-exploitation indicators such as unusual outbound traffic or persistence on iOS endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.