Live › vulnerability › CVE-2026-84526
Apple's 26.7 security notes list many memory-corruption and permission flaws across iPhone and iPad components, mostly letting a local app crash the system or read protected data. Some entries say a sandboxed app could execute code with kernel privileges or write kernel memory, and a few say a remote attacker could run code over Bluetooth or through crafted media.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:58 UTC, 0h before NVD. All times on this page are UTC.
The advisory covers iPhone 11 and later and the listed iPad models, across many system components including Bluetooth, media playback, the Accessibility framework and the kernel-level APFS file system. Devices that have not installed 26.7 are exposed to the listed flaws, while the sources do not say which flaws need a specific setting or a paired device. Limit the exposure by installing the update on all managed phones and tablets.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apple ipados | vendor | < 26.7 | 26.7 |
| apple iphone os | vendor | < 26.7 | 26.7 |
| apple macos | vendor | >= 15.0, < 15.8 | 15.8 |
| apple macos | vendor | >= 26.0, < 26.7 | 26.7 |
| apple tvos | vendor | < 27.0 | 27.0 |
| apple visionos | vendor | < 27.0 | 27.0 |
| apple watchos | vendor | < 27.0 | 27.0 |
26.7.26.7Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
About the security content of iOS 26.7 and iPadOS 26.7 - Apple Support
This document describes the security content of iOS 26.7 and iPadOS 26.7.
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
Released September 14, 2026
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: Processing a maliciously crafted image may lead to unexpected process termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-86882: Peter Malone
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43664: Stuart Wallace, Rosyna Keller of Totally Not Malicious Software, Jian Lee (@speedyfriend433), Ilya Andr (andrd3v), Gongyu Ma (@Mezone0), David Strnadel, Daniel Febrero, CJ Vana, Asaf Cohen
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to cause unexpected system termination or write kernel memory
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input validation.
CVE-2026-65408: tamdao
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: Mounting a disk image with maliciously crafted files may lead to unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-84519: Richard Zana
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional restrictions.
CVE-2026-84583: Zhongcheng Li from IES Red Team
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved checks.
CVE-2026-65410: Calif.io in collaboration with Claude and Anthropic Research
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory handling.
CVE-2026-84616: Peter Malone
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: A sandboxed app may be able to execute arbitrary code with kernel privileges
Description: A race condition was addressed with improved state management.
CVE-2026-84607: Ruslan Dautov
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved validation.
CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security
Available for: iPhone 11 and later
Impact: An attacker in a privileged network position may be able to cause a denial-of-service
Description: A denial-of-service issue was addressed with improved input validation.
CVE-2026-86963: Beomseok Oh (@KAIST), Yongdae Kim (@KAIST)
Entry added October 19, 2026
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: A remote attacker may be able to cause unexpected app termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved bounds checking.
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An attacker in radio range may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-84613: jioundai
Entry added October 19, 2026
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An archive may be able to bypass Gatekeeper
Description: A file quarantine bypass was addressed with additional checks.
CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola, an anonymous researcher
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An attacker with a paired Bluetooth device may be able to execute arbitrary code
Description: A stack overflow was addressed with improved input validation.
CVE-2026-86919: Mathis Mansière
Entry added October 19, 2026
Available for: iPhone 11 and later, iPad Pro
This page as .md · .json · in your agent: get_signal("CVE-2026-84526")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.