Virsec Sues Apple in Austin on Two Memory Corruption Patents, Targeting Pointer Authentication and Memory Integrity Enforcement.

The case

The case is Virsec Systems, Inc. v. Apple Inc., No. 1:26-cv-02992 (W.D. Tex., Austin Division), filed October 23, 2026, ECF No. 1. The complaint is signed by James C. Yoon of Wilson Sonsini Goodrich & Rosati in Palo Alto, California, and also lists Ryan R. Smith of the same firm. It describes Virsec as a Delaware corporation based in San Jose, California, and Apple as a California corporation with facilities in Austin, Texas. Venue is pleaded under 28 U.S.C. 1391(b) and (c) and 1400(b), citing Apple's Austin corporate campus and offices and its retail stores in the district, and the complaint alleges, on information and belief, that Apple employees there, including engineering personnel, use, develop and test the accused products. The docket shows a request for issuance of summons, a notice of the patent filing to the USPTO and a Rule 7 disclosure statement, all filed October 23.

The two patents and the asserted claims

Both patents are titled System and Methods for Run Time Detection and Correction of Memory Corruption. The complaint says they stem from provisional application 60/771,734, filed February 9, 2006, and application 11/673,541, filed February 9, 2007, and that the '312 patent issued February 24, 2015 and the '888 patent on June 25, 2019. It says Virsec holds all rights in both.

Claim 1 of the '312 patent covers a method that detects, at run time, an application layer memory corruption of part of a control section of original memory by malicious code, where the corruption would otherwise affect the application's execution flow. Detection uses at least two different invariant checks. Each check captures the state of one or more registers and part of a data segment of the control section before a function call, checks the state after the call against what was captured, and declares a memory corruption if they do not match. The method then reports the corruption to a user.

Claim 11 of the '888 patent covers detecting an application layer memory corruption caused by a heap attack. Within a given time frame, the method captures a shadow copy of a checksum for heap metadata, calculates a current checksum after a heap operation, checks one against the other, and declares a memory corruption if they do not match. It then automatically detects a security attack based on that declaration and reports it to a user.

The complaint describes the problem the patents address as memory corruption attacks, such as buffer overflow, format string, heap metadata and pointer hijacking attacks, and says the countermeasures of the time, signature based detection, vendor patching and hardware memory error correction, were not satisfactory. It describes the patents' approach as checking structural invariants at run time against previously captured or expected state.

What Apple technology is accused

The complaint alleges that Apple introduced the arm64e architecture and pointer authentication codes beginning in 2018 with the A12 processor in the iPhone XS and iPhone XR, and quotes Apple as saying that when a pointer fails authentication, the processor "interprets authentication failure as memory corruption," which the complaint says causes the application to crash. It also points to immediate trap by libmalloc, memory integrity enforcement, and Private Cloud Compute, Apple's cloud service on Apple silicon servers launched in 2024.

The named accused products are the iPhone 17, iPhone 17 Pro, iPhone 17 Pro Max, iPhone Air, iPhone 18 Pro and iPhone 18 Pro Max, iPad (M5), Mac computers (M5), Apple Watch Series 12, Apple TV 4K and their operating systems, Xcode, Apple Clang, and the Private Cloud Compute servers and service. Exhibit 3 charts claim 1 of the '312 patent and Exhibit 8 charts claim 11 of the '888 patent.

The counts and the knowledge allegations

Count I, on the '312 patent, and Count II, on the '888 patent, each allege direct infringement under 35 U.S.C. 271(a), giving Apple's operation of the Private Cloud Compute servers as an example and alleging, on information and belief, that Apple performs the methods when developing and testing the products. Each also alleges induced infringement under 35 U.S.C. 271(b), citing Apple developer documentation that instructs developers to build arm64e binaries with pointer authentication, and contributory infringement under 35 U.S.C. 271(c).

For knowledge, the complaint alleges that in early 2017 the parties held discussions ending with a technical deep dive by Virsec, after which Apple went silent, and that Apple knew of the '312 patent at least as a result of those interactions. It alleges, on information and belief, that Apple investigated Virsec's patent portfolio and so found the '312 patent. It alleges that Apple knew of the '888 patent on or shortly after its June 25, 2019 issue date, on information and belief because Apple monitored the patent family after its 2017 evaluation of Virsec. In the alternative it pleads, on information and belief, willful blindness. Each count alleges willful infringement for purposes of 35 U.S.C. 284.

The relief sought

Virsec asks for a judgment of direct, induced or contributory infringement, compensatory damages including lost profits and no less than a reasonable royalty, a finding of willfulness and increased damages under 35 U.S.C. 284, interest, attorney fees and costs under 35 U.S.C. 285, and an accounting and supplemental damages from six years before filing through final judgment. It demands a jury.

Virsec filed a parallel suit against Microsoft Corporation on the same two patents in the same court on October 16, 2026, No. 1:26-cv-02934.