CVE-2016-1827

Published: May 20, 2016Updated: May 6, 2026 Sources: CVE List NVD BDUCWE-119

7.8HIGH

NVD MITRE

Description

The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1828, CVE-2016-1829, and CVE-2016-1830.

In plain language

AI Worth attention

This iOS/macOS/tvOS/watchOS kernel bug could let a malicious app crash the device or possibly run code with high privileges on older versions, so you should upgrade if you’re still using those versions.

Executive summary

CVE-2016-1827 is a memory-corruption kernel vulnerability (CWE-119) in Apple iOS/OS X/macOS, tvOS, and watchOS versions prior to the fixed releases; it can be triggered via a crafted app to execute code in a privileged context or cause denial of service.

If affected, business impact

Device crashes and downtimePotential full device compromisePrivileged data exposure riskSecurity incident from malicious apps

What to do now

Check which Apple OS versions your business devices are running (iPhone/iPad on iOS, Macs on macOS/OS X, Apple TV on tvOS, Apple Watch on watchOS).
Update iPhone/iPad to iOS 9.3.2 or later.
Update Mac computers to 10.11.5 or later.
Update Apple TV to tvOS 9.2.1 or later.
Update Apple Watch to watchOS 2.2.1 or later.
If you cannot upgrade immediately, limit use of untrusted apps on affected devices until you can patch.

Patch / advisory Usually a quick update

What is it

Think of the device’s kernel as the “core controller” that everything relies on. This bug is like a flaw in how the controller handles certain app-crafted behavior: a malicious app could make the device crash (denial of service), and in the worst case could gain very powerful control.

Who is affected

This matters if your business uses Apple mobile or computing devices running affected older OS versions: iOS, macOS/OS X, tvOS, or watchOS prior to the fixed releases. It’s primarily a concern when an attacker can get a crafted app to run on a device (so it’s not just “anyone can hit you from the network”). The risk is mainly “reachability” through the device and the ability to run a malicious app on it.

How urgent is it

The traffic-light status is AMBER because this is a high-severity kernel flaw and the likelihood trend is rising. Even though there’s no KEV listing and no public exploit code recorded, the impact (crash or privileged code execution) is serious enough to prioritize upgrades of any affected devices.

What to do — in detail

Inventory affected devices
- Identify every device type and OS version in use: iPhones/iPads (iOS), Macs (macOS/OS X), Apple TV (tvOS), and Apple Watch (watchOS).
- Record the exact version numbers.
Determine whether each device is vulnerable
- iOS is vulnerable if it is before 9.3.2.
- macOS/OS X is vulnerable if it is before 10.11.5.
- tvOS is vulnerable if it is before 9.2.1.
- watchOS is vulnerable if it is before 2.2.1.
Upgrade to the fixed versions
- Upgrade each affected device directly to the fixed versions: iOS 9.3.2+, OS X/macOS 10.11.5+, tvOS 9.2.1+, watchOS 2.2.1+.
- Plan downtime windows if needed, since OS updates can require device restarts.
Temporary workaround if patching is delayed
- Reduce exposure by restricting installation and use of untrusted apps on any device still on a vulnerable version.
- Prefer only apps from trusted sources and ensure users are not installing unknown/unverified software.
What to monitor after updating
- Confirm devices report the updated OS version successfully.
- If any device experienced unexplained crashes before the update, watch for repeat crashes and investigate the apps used around the time of incidents.
Reference timing guidance
- No KEV due date was provided in the findings because this CVE is not listed in CISA KEV.

Technical context

CVE-2016-1827 is a memory-corruption issue in the Apple kernel across iOS, OS X/macOS, tvOS, and watchOS. The weakness is categorized as CWE-119. Mechanism: a crafted app can trigger memory corruption leading to denial of service or code execution in a privileged context.

Findings summary: no KEV entry; no public exploit code on record; exploitation status is not confirmed by KEV/news; however, press attention and the predicted likelihood are rising (EPSS was noted as a prediction only, so it should not be used as evidence of real-world exploitation).

Explosion maturity: no public exploit code recorded suggests limited publicly available exploitation maturity at the time of the findings, but the kernel impact means upgrades are still important for affected versions.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:LAttack Vector

Local

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:RUser Interaction

Required

Scope

S:UScope

Unchanged

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-119

Affected Products

Apple Inc.

commercial·USaka apple, apple computer

iOSEmbeddedOS

Operating Systems / mobile-os

OS X

Operating Systems

mac os xOn-premOS

Operating Systems / unix-bsd

tvosEmbeddedOS

Operating Systems / mobile-os

watchosEmbeddedOS

Operating Systems / mobile-os

and 2 more affected products View all →

Exploitability

Official Patch Available

Is your org exposed to CVE-2016-1827?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques

Initial Access

Privilege Escalation

View detailed technique mapping

References

https://support.apple.com/HT206568

support.apple.com

https://support.apple.com/HT206567

support.apple.com

https://support.apple.com/HT206566

support.apple.com

and 14 more references View all →

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2016-1827 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows