PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7665 Apple CVE debrief

CVE-2016-7665 describes a denial-of-service issue in Apple’s iOS Graphics Driver component affecting iOS versions before 10.2. The public description says a crafted video could be used by remote attackers to disrupt service. Apple’s advisory and NVD record are the key public references for affected versions and remediation context.

Vendor
Apple
Product
CVE-2016-7665
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

Organizations and users running iPhones or iPads on iOS before 10.2 should care, especially where devices may process untrusted video content or receive media from external sources. Security teams managing Apple mobile fleets should prioritize confirming upgrade status.

Technical summary

The vulnerable component is the iOS Graphics Driver. The issue is described as a crafted-video-triggered denial of service, with the affected range ending before iOS 10.2. NVD classifies the weakness as CWE-20 and records a CVSS v3.0 vector of CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating availability impact and user interaction in its scoring model. The public CVE description also characterizes the attacker as remote, so the exposure context should be read carefully against the delivery path for the malformed media.

Defensive priority

Medium. The issue is primarily an availability concern rather than a confidentiality or integrity compromise, but it can still disrupt device use and may affect fleets that handle untrusted media. Patch confirmation is the main control.

Recommended defensive actions

  • Upgrade affected iOS devices to iOS 10.2 or later.
  • Inventory managed Apple devices and verify no endpoints remain on versions before 10.2.
  • Limit exposure to untrusted or unsolicited video content where practical until patching is complete.
  • Use mobile device management or compliance tooling to flag outdated iOS versions.
  • Review Apple’s security advisory and NVD entry for version-specific guidance and validation.

Evidence notes

Supported by the CVE description stating that iOS before 10.2 is affected and that the issue involves the Graphics Driver component. Apple’s advisory is listed as the vendor reference in NVD. NVD also provides the CVSS vector and CWE-20 classification. The public sources do not provide deeper implementation detail beyond denial of service via crafted video.

Official resources

Publicly listed by NVD on 2017-02-20. NVD metadata shows the record was modified on 2026-05-13. Use the published CVE date for timing context, not the later modification date.