CVE-2016-4655
Apple Iphone Os ≤ 9.3.5
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NSummary
CVE-2016-4655 is a medium-severity an unspecified weakness vulnerability in Apple Iphone Os. Its CVSS base score is 5.5 (Medium).
Operationally, ranked in the top 2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The kernel component of Apple iOS versions prior to 9.3.5 is affected by an information disclosure vulnerability that permits reading of sensitive data from memory. The flaw is reachable through a crafted application and carries a CVSS 3.1 base score of 5.5, reflecting local attack vector, low complexity, no required privileges, and required user interaction for high confidentiality impact with no integrity or availability consequences.
An attacker who can persuade a user to install and run a malicious application on an unpatched device can exploit the issue to extract kernel memory contents. Because the vector is local and the vulnerability resides in the kernel, the attack does not require network access or elevated privileges beyond the ability to execute the crafted app.
Apple security announcements for iOS 9.3.5 and the subsequent September 2016 updates state that the issue is resolved by installing the patched kernel; administrators and users are advised to apply the available iOS updates to eliminate the exposure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2016-5641
Vulnerability Data
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.
- CWE(s)
- KEV Date Added
- 24 May 2022
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.