CVE-2016-4656 is a critical memory corruption vulnerability in the Apple iOS kernel, affecting iOS versions prior to 9.3.5. This flaw allows an attacker to execute arbitrary code with elevated privileges or cause a denial of service via a crafted application. With a CVSS score of 7.8 (HIGH), it has a low attack complexity and requires user interaction (UI:R) to exploit, but can lead to complete compromise of confidentiality, integrity, and availability. This vulnerability is actively exploited in the wild, notably as part of the Pegasus spyware, and has publicly available exploit modules in Metasploit. It has garnered significant community discussion and media coverage, highlighting its severe impact.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 9.3.5CPE matchmatch criteria | cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.