CVE-2016-4656
Apple iOS Memory Corruption Vulnerability
Description
CVE-2016-4656 is a memory corruption vulnerability in the Apple iOS kernel that allows attackers to execute code in a privileged kernel context or cause a denial-of-service (DoS) via a crafted application. This vulnerability was part of the Pegasus/Trident exploit chain used by the NSO Group, where it served as the kernel privilege escalation component that achieved a persistent jailbreak with root-level access. Combined with CVE-2016-4655 (kernel KASLR bypass) and CVE-2016-4657 (WebKit remote code execution), this vulnerability enabled the complete remote compromise of iOS devices. CISA has added CVE-2016-4656 to its KEV catalog, and the EPSS percentile of 98.5% indicates near-certain exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | iphone os | < 9.3.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://lists.apple.com/archives/security-announce/2016/Aug/msg00000.html(Broken Link, Mailing List, Vendor Advisory)
- http://www.securityfocus.com/bid/92652(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1036694(Broken Link, Third Party Advisory, VDB Entry)
- https://blog.lookout.com/blog/2016/08/25/trident-pegasus/(Broken Link)
- https://support.apple.com/HT207107(Release Notes, Vendor Advisory)
- https://www.exploit-db.com/exploits/44836/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4656(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119 describes a weakness where a product performs operations on a memory buffer without properly restricting those operations to the intended boundaries. In CVE-2016-4656, the Apple iOS kernel contains a memory corruption flaw that allows a crafted application to corrupt kernel memory structures, leading to arbitrary code execution with kernel-level privileges and enabling a persistent device jailbreak.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2016-4656 enables kernel-level code execution on Apple iOS devices, representing the most severe type of mobile security vulnerability. Successful exploitation grants the attacker complete control over the device, including the ability to install persistent surveillance software, intercept all communications, access encrypted data, and activate device sensors such as microphone and camera. The vulnerability is exploitable through a crafted application, and in the Pegasus chain it was reached after initial code execution through a WebKit vulnerability. The impact on confidentiality, integrity, and availability is total, as kernel-level access bypasses all iOS security controls including the application sandbox, code signing, and data protection. The EPSS percentile of 98.5% reflects near-certain exploitation, and CISA has confirmed active exploitation in the KEV catalog.
Exploit Maturity
CVE-2016-4656 was exploited as a zero-day vulnerability as part of the Pegasus/Trident exploit chain discovered in August 2016. CISA has confirmed active exploitation and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 14, 2022. The EPSS percentile of 98.5% indicates near-certain exploitation probability. The NSO Group developed the exploit as part of their Pegasus commercial spyware platform, which was sold to government clients worldwide and used to target journalists, human rights activists, lawyers, and political figures. The Trident chain (CVE-2016-4657 + CVE-2016-4655 + CVE-2016-4656) demonstrated a full remote-to-kernel exploit requiring only that the victim clicked a single link.
Remediation
- Update Apple iOS to version 9.3.5 or later, which patches CVE-2016-4656 along with the other Pegasus/Trident vulnerabilities. Apply updates per vendor instructions as required by CISA's KEV catalog.
- Enable automatic updates on all iOS devices to ensure timely deployment of kernel security patches.
- Deploy mobile device management (MDM) solutions to enforce update compliance and detect jailbreak indicators that suggest kernel exploitation.
- Avoid clicking links from unknown or untrusted sources, as the Pegasus exploit chain was initiated via malicious links delivered through SMS and messaging applications.
- For high-value targets at risk of state-sponsored surveillance, enable Apple's Lockdown Mode and limit the installation of applications to only those from verified, trusted sources.
Technical Details
CVE-2016-4656 is a kernel memory corruption vulnerability in Apple iOS. The flaw exists in the kernel's handling of certain memory operations, falling under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). An attacker with code execution in user space (achieved through CVE-2016-4657 in the Pegasus chain) can trigger this vulnerability to corrupt kernel memory structures in a controlled manner. By first obtaining the kernel base address through CVE-2016-4655 (KASLR bypass), the attacker can precisely target kernel data structures and redirect execution flow to achieve arbitrary kernel code execution. The end result is a persistent jailbreak that survives reboots, granting the attacker root-level access to all iOS security domains. The vulnerability affects the core kernel memory management and is exploitable from any code execution context on the device.
Frequently Asked Questions
Is CVE-2016-4656 being actively exploited?
Yes, CVE-2016-4656 was exploited as a zero-day in the NSO Group's Pegasus spyware chain. CISA has confirmed active exploitation and added it to the KEV catalog. The EPSS percentile of 98.5% reflects near-certain exploitation activity, driven by the Pegasus commercial spyware platform.
What products are affected by CVE-2016-4656?
CVE-2016-4656 affects Apple iOS versions prior to 9.3.5. The vulnerability is in the iOS kernel and impacts all iPhone and iPad models running affected firmware versions.
How do I fix CVE-2016-4656?
Update Apple iOS to version 9.3.5 or later. Enable automatic updates and deploy MDM solutions for enterprise fleet management. See the Remediation section for additional security measures.
How severe is CVE-2016-4656?
CVE-2016-4656 is a kernel memory corruption vulnerability with an EPSS percentile of 98.5%. It enables complete device compromise through kernel-level code execution, allowing persistent surveillance, data theft, and full bypass of iOS security controls. As part of the Pegasus/Trident chain, it demonstrated one of the most severe real-world mobile exploit scenarios ever documented.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.