CVE-2016-4656

What Is Apple iOS?

Apple iOS is the operating system for iPhone and iPad. Complete iPhone compromise — enabling persistent access to messages, calls, emails, camera, microphone, and location — requires chaining multiple vulnerabilities across the browser (initial entry), kernel (privilege escalation), and persistence layers. Zero-day iOS exploit chains achieving this level of compromise command the highest prices in commercial vulnerability markets and are exclusively used by well-resourced threat actors.

Overview

CVE-2016-4656 is the third and final stage of the Trident iOS zero-day exploit chain used by NSO Group's Pegasus spyware. After CVE-2016-4657 (WebKit RCE) and CVE-2016-4655 (kernel KASLR bypass) execute, CVE-2016-4656 delivers the kernel memory corruption exploit that escalates from renderer-level code execution to full kernel control — achieving a complete remote jailbreak. This kernel-level access allows Pegasus to install persistent spyware invisible to the user, with access to all iOS communications, camera, microphone, and location data. Discovered by Citizen Lab and Lookout Security. Apple patched all three Trident vulnerabilities in iOS 9.3.5 on August 25, 2016. CISA added CVE-2016-4656 to the KEV catalog in May 2022.

Affected Versions

Technical Details

The Trident Exploit Chain

CVE-2016-4656 is Stage 3 of the Trident three-stage exploit chain:

Root Cause: Kernel Memory Corruption

CVE-2016-4656 is an out-of-bounds write vulnerability (CWE-787) in the iOS kernel. After CVE-2016-4655 provides the kernel memory layout (defeating KASLR), CVE-2016-4656 exploits a memory corruption flaw in the kernel — likely in kernel extension (kext) processing, mach messaging, or memory management subsystems — to achieve a controlled out-of-bounds write.

With known kernel addresses from Stage 2 and a controlled kernel write from Stage 3, Pegasus could:

1. Overwrite kernel data structures — modify task control blocks, credential structures, or security policy flags
2. Elevate to root — escalate from the sandboxed WebKit process to full root/kernel privileges
3. Disable iOS security mechanisms — bypass code signing, disable sandboxing, and circumvent kernel integrity checks
4. Achieve persistence — modify the iOS filesystem to install Pegasus as a persistent background process that survives reboots

Pegasus Spyware Capabilities

Once CVE-2016-4656 achieved kernel control, the Pegasus installation provided:

• Complete interception of iMessage, WhatsApp, Gmail, and other messaging apps
• Real-time microphone and camera access
• GPS location tracking
• Contact list and calendar exfiltration
• Call interception

Attack Characteristics

Discovery

Discovered by Citizen Lab and Lookout Security through analysis of a suspicious link sent to UAE human rights activist Ahmed Mansoor on August 10, 2016. Citizen Lab's investigation identified all three Trident zero-days and documented NSO Group's Pegasus spyware infrastructure. Apple was notified and released iOS 9.3.5 within 10 days.

Exploitation Context

• NSO Group's Pegasus: CVE-2016-4656 was the LPE component of NSO Group's Pegasus v2.x, a commercial surveillance product sold to nation-state clients; the Trident chain represented the state-of-the-art in mobile exploitation and was used to target political dissidents, journalists, and human rights activists
• Million-dollar iOS zero-day: At 2016 exploit market valuations, three iOS zero-days chained for remote jailbreak were worth approximately $1 million USD; NSO Group's clients paid for this capability as a service
• Activist and journalist targeting: Citizen Lab documented Pegasus use against Ahmed Mansoor (UAE), Rafael Cabrera (Mexico), and researchers in Kazakhstan, Turkey, and across the Middle East — consistent with government targeting of civil society
• Watershed event: The Trident/Pegasus disclosure drove significant investment in iOS security, including the creation of Apple's Lockdown Mode and accelerated iOS security research globally
• CISA KEV (2022): Added May 2022 alongside CVE-2016-4655 and CVE-2016-4657

Remediation

1. Update to iOS 9.3.5 or later — all iOS versions from 9.3.5 onward patch the Trident vulnerabilities. Any current iOS release is patched. Update via Settings → General → Software Update.

2. Enable automatic iOS updates — configure iOS to automatically install security updates; mobile zero-day exploitation windows are short once patches are released, and automatic updates minimize exposure.

3. Use Apple Lockdown Mode for high-risk users — Lockdown Mode (iOS 16+) significantly reduces iOS attack surface by disabling many WebKit features, JIT compilation, and message link previews that form the entry point for mobile exploit chains; recommended for journalists, activists, and others at high risk of state-sponsored targeting.

4. Check for Pegasus indicators — Amnesty International's Mobile Verification Toolkit (MVT) and iMazing can detect Pegasus indicators in iOS backups; individuals concerned about targeting should use these tools.