Just like everyone else who unboxed their brand new iPhone 17 Pro Max, the first thing we did was run some code containing a use-after-free memory error and a buffer overflow to take an in-depth look at Apple’s new security feature, Memory Integrity Enforcement (MIE). Taking pet photos with a new phone can wait a bit longer.
The most common mobile exploits leverage vulnerabilities that enable memory corruption, allowing an attacker’s code to gain initial execution on the target device and escalate its privileges. When memory corruption is detected in processes protected by MIE, depending on how MIE is configured for the process, it can immediately terminate the process, halting the exploit before it can execute further, or the event is logged to record the anomaly while the process is allowed to continue running (since most of the time it will be benign and not an exploit). Apple added MIE capabilities to the A19 and A19 Pro processors used in all iPhone 17 series devices, with support built into iOS 26.
When we ran the memory corruption functions in the test process, the process was immediately terminated and a crash report with MIE-specific violations was generated. This test confirmed that we are looking for the right log entries and crash reports tied to MIE violations.
When some of our users upgraded to iPhone 17 series devices on release day, we immediately started seeing sysdiagnose submissions from these devices and began manually reviewing them for signs of MIE events as we prepared our analysis tools to perform this check in an automated fashion. Our analysis tools now automatically check for these types of events occurring on all iPhone 17 series devices. All of our products, Private Protection (for government), Am I Secure? (for individual consumers) and Am I Secure? Endpoint Security (for government and enterprise) now perform this check. Like any other anomaly our automated analysis process finds, they will be sent for human review. We will alert users to events that are indicative of attempted exploitation, even if MIE blocked it. We will also share technical details from the crash reports with the relevant software vendor so they can resolve the bug.
Based on government client feedback, top national leadership in many countries are upgrading to iPhone 17 series devices specifically due to the MIE protections. MIE will dramatically reduce the attack surface, especially as more processes in iOS utilize it (not all do, just the highest risk ones) and as app developers start enabling MIE/Enhanced Security in Xcode for their apps.
At the moment, end users cannot directly view MIE-related events. They are visible only in crash reports or sysdiagnose logs. Even so, this represents one of the most meaningful security improvements Apple has introduced in years.
