--- id: "CVE-2026-28966" kind: "vulnerability" aliases: ["CVE-2026-28966"] title: "An out-of-bounds write issue was addressed with improved bounds checking" severity: "medium" cvss: 4.3 epss: null exploited: false status: "open" category: "vendor" products: [{"name": "apple ipados", "fixed": ["26.7"], "affected": "< 26.7", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["26.7"], "affected": "< 26.7", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["15.8"], "affected": ">= 15.0, < 15.8", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["26.7"], "affected": ">= 26.0, < 26.7", "ecosystem": "vendor"}, {"name": "apple tvos", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}, {"name": "apple visionos", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "ios", "ipad", "ipados", "iphone", "vendor", "vendor-advisory"] not_affected_if: ["already-on-26.7-or-later"] published_at: "2026-09-14T21:17:05+00:00" first_seen_at: "2026-11-04T00:58:50+00:00" updated_at: "2026-11-04T01:16:37+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/149041", "first_seen_at": "2026-11-04T00:58:50+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28966", "first_seen_at": "2026-11-04T01:16:37+00:00"}] --- # An out-of-bounds write issue was addressed with improved bounds checking Apple's iOS 26.7 and iPadOS 26.7 security notes list many separate flaws, including memory corruption and permission bypasses that can let an app crash the system, read sensitive data or, in some entries, run code. The excerpt is cut off, and this record covers the whole advisory rather than one specific CVE. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:apple ipados affected < 26.7 fixed 26.7 - vendor:apple iphone os affected < 26.7 fixed 26.7 - vendor:apple macos affected >= 15.0, < 15.8 fixed 15.8 - vendor:apple macos affected >= 26.0, < 26.7 fixed 26.7 - vendor:apple tvos affected < 27.0 fixed 27.0 - vendor:apple visionos affected < 27.0 fixed 27.0 ## How to check - Open Settings > General > About on the iPhone or iPad and compare the iOS or iPadOS version with `26.7` ## Fix - iOS and iPadOS: move to `26.7` or later, as stated by the Apple advisory ## Timeline - 2026-11-04T00:58:50+00:00 lab https://support.apple.com/en-us/149041 — Apple: About the security content of iOS 26.7 and iPadOS 26.7 - Apple Support - 2026-11-04T01:16:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-28966 ## Documents - [advisory] Apple: About the security content of iOS 26.7 and iPadOS 26.7 - Apple Support https://support.apple.com/en-us/149041 - [advisory] Apple: About the security content of iOS 27 and iPadOS 27 - Apple Support https://support.apple.com/en-us/149034 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/149035 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/149036 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/149038 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/149042 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/149043 ## From the sources About the security content of iOS 26.7 and iPadOS 26.7 - Apple Support # About the security content of iOS 26.7 and iPadOS 26.7 This document describes the security content of iOS 26.7 and iPadOS 26.7. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## iOS 26.7 and iPadOS 26.7 Released September 14, 2026 ### Accelerate Framework Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted image may lead to unexpected process termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86882: Peter Malone ### Accessibility Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43664: Stuart Wallace, Rosyna Keller of Totally Not Malicious Software, Jian Lee (@speedyfriend433), Ilya Andr (andrd3v), Gongyu Ma (@Mezone0), David Strnadel, Daniel Febrero, CJ Vana, Asaf Cohen ### APFS Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84523: Cem Onat Karagun, an anonymous researcher ### Apple Neural Engine Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-65408: tamdao ### AppleAVD Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-65407: Franco Belman at Blackwing Intelligence ### AppleDouble Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Mounting a disk image with maliciously crafted files may lead to unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84519: Richard Zana ### AuthKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A local app may be able to read a persistent account identifier Description: A permissions issue was addressed with additional restrictions. CVE-2026-84583: Zhongcheng Li from IES Red Team ### AVEVideoEncoder Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: The issue was addressed with improved checks. CVE-2026-65410: Calif.io in collaboration with Claude and Anthropic Research ### AVEVideoEncoder Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: A type confusion issue was addressed with improved memory handling. CVE-2026-84616: Peter Malone ### AVEVideoEncoder Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A sandboxed app may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved state management. CVE-2026-84607: Ruslan Dautov ### BackgroundAssets Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: A logic issue was addressed with improved validation. CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security ### Baseband Available for: iPhone 11 and later Impact: An attacker in a privileged network position may be able to cause a denial-of-service Description: A denial-of-service issue was addressed with improved input validation. CVE-2026-86963: Beomseok Oh (@KAIST), Yongdae Kim (@KAIST) Entry added October 19, 2026 ### Bluetooth Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A remote attacker may be able to cause unexpected app termination or arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. ### Bluetooth Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An attacker in radio range may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84613: jioundai Entry added October 19, 2026 ### copyfile Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An archive may be able to bypass Gatekeeper Description: A file quarantine bypass was addressed with additional checks. CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola, an anonymous researcher ### Core Bluetooth Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An attacker with a paired Bluetooth device may be able to execute arbitrary code Description: A stack overflow was addressed with improved input validation. CVE-2026-86919: Mathis Mansière Entry added October 19, 2026 ### CoreAudio Available for: iPhone 11 and later, iPad Pro --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_