--- id: "CVE-2026-84597" page: "https://infrastack.ai/live/CVE-2026-84597" kind: "vulnerability" aliases: ["CVE-2026-84597"] title: "An out-of-bounds read issue was addressed with improved input validation" severity: "medium" cvss: 6.5 epss: null exploited: false status: "open" category: "infrastructure" products: [{"name": "tvOS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}, {"name": "apple tvos", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}, {"name": "apple visionos", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}, {"name": "apple watchos", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "apple-tv", "infrastructure", "tvos", "vendor-advisory"] not_affected_if: ["tvos-27-or-later"] published_at: "2026-09-14T21:17:35+00:00" first_seen_at: "2026-11-10T00:17:02+00:00" updated_at: "2026-11-10T00:28:45+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/149036", "first_seen_at": "2026-11-10T00:17:02+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149037", "first_seen_at": "2026-11-10T00:17:03+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149038", "first_seen_at": "2026-11-10T00:17:04+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84597", "first_seen_at": "2026-11-10T00:28:45+00:00"}] exploit_sources: [] --- # An out-of-bounds read issue was addressed with improved input validation Link for people: https://infrastack.ai/live/CVE-2026-84597 (this .md is for agents) A font parsing component in tvOS 27 reads memory outside its bounds when it processes a maliciously crafted font. An attacker can use this to disclose process memory. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:tvOS affected range not listed fixed no fixed version listed - vendor:apple ipados affected < 27.0 fixed 27.0 - vendor:apple iphone os affected < 27.0 fixed 27.0 - vendor:apple macos affected < 27.0 fixed 27.0 - vendor:apple tvos affected < 27.0 fixed 27.0 - vendor:apple visionos affected < 27.0 fixed 27.0 - vendor:apple watchos affected < 27.0 fixed 27.0 ## How to check - Check the tvOS version on the Apple TV; anything older than `tvOS 27` is in scope for this advisory. - Confirm the device is an Apple TV 4K (2nd generation or later), the models listed as affected. ## Fix - Apple TV 4K (2nd generation and later): update to `tvOS 27`, the release this advisory covers. ## Timeline - 2026-11-10T00:17:02+00:00 lab https://support.apple.com/en-us/149036 — Apple: About the security content of tvOS 27 - Apple Support - 2026-11-10T00:17:03+00:00 lab https://support.apple.com/en-us/149037 — Apple: About the security content of watchOS 27 - Apple Support - 2026-11-10T00:17:04+00:00 lab https://support.apple.com/en-us/149038 — Apple: About the security content of visionOS 27 - Apple Support - 2026-11-10T00:28:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-84597 ## Documents - [advisory] Apple: About the security content of iOS 27 and iPadOS 27 - Apple Support https://support.apple.com/en-us/149034 - [advisory] Apple: About the security content of macOS Golden Gate 27 - Apple Support https://support.apple.com/en-us/149035 - [advisory] Apple: About the security content of tvOS 27 - Apple Support https://support.apple.com/en-us/149036 - [advisory] Apple: About the security content of watchOS 27 - Apple Support https://support.apple.com/en-us/149037 - [advisory] Apple: About the security content of visionOS 27 - Apple Support https://support.apple.com/en-us/149038 - [mentions] Apple: About the security content of tvOS 27 - Apple Support https://support.apple.com/en-us/149036 - [mentions] Apple: About the security content of visionOS 27 - Apple Support https://support.apple.com/en-us/149038 - [mentions] Apple: About the security content of watchOS 27 - Apple Support https://support.apple.com/en-us/149037 ## From the sources About the security content of tvOS 27 - Apple Support # About the security content of tvOS 27 This document describes the security content of tvOS 27. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## tvOS 27 Released September 14, 2026 ### Accelerate Framework Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted image may lead to unexpected process termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86882: Peter Malone ### Accelerate Framework Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted image may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86918: Arni Hardarson (Neonix Security) Entry added October 19, 2026 ### Accessibility Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of Totally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero, Asaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433) ### APFS Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84523: Cem Onat Karagun, an anonymous researcher ### App Intents Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved access restrictions. CVE-2026-84582: Zhongcheng Li (CK01) Entry added October 19, 2026 ### App Store Available for: Apple TV 4K 2nd generation and later Impact: A local app may be able to read a persistent account identifier Description: A permissions issue was addressed with additional restrictions. CVE-2026-86888: Zhongcheng Li (CK01) ### AppleAVD Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-65407: Franco Belman at Blackwing Intelligence ### Audio Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to leak sensitive user information Description: A logic issue was addressed with improved checks. CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin ### AuthKit Available for: Apple TV 4K 2nd generation and later Impact: A local app may be able to read a persistent account identifier Description: A permissions issue was addressed with additional restrictions. CVE-2026-84583: Zhongcheng Li from IES Red Team ### AVEVideoEncoder Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination Description: The issue was addressed with improved checks. CVE-2026-65410: Calif.io in collaboration with Claude and Anthropic Research ### AVEVideoEncoder Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination Description: A type confusion issue was addressed with improved memory handling. CVE-2026-84616: Peter Malone ### AVEVideoEncoder Available for: Apple TV 4K 2nd generation and later Impact: A sandboxed app may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved state management. CVE-2026-84607: Ruslan Dautov ### BackgroundAssets Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to access sensitive user data Description: A logic issue was addressed with improved validation. CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security ### Bluetooth Available for: Apple TV 4K 2nd generation and later Impact: A remote attacker may be able to cause unexpected app termination or arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. ### Bluetooth Available for: Apple TV 4K 2nd generation and later Impact: An app may gain unauthorized access to Bluetooth Description: An authorization issue was addressed with improved state management. CVE-2026-84560: an anonymous researcher ### Bluetooth Available for: Apple TV 4K 2nd generation and later Impact: An attacker in radio range may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84613: jioundai Entry added October 19, 2026 ### CloudKit Available for: Apple TV 4K 2nd generation and later Impact: A local app may be able to read a persistent account identifier Description: An information disclosure issue was addressed with improved state management. CVE-2026-86895: Stanislav Jelezoglo ### CloudKit Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to read device name Description: A permissions issue was addressed with additional restrictions. CVE-2026-86893: Heiner Gerdes ### Core Bluetooth Impact: Processing a maliciously crafted Bluetooth packet may result in disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112608: Duc Anh Nguyen & Ta Duc Thien Entry added October 26, 2026 ### CoreMedia Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-65344: Siyeong kim ### CoreMedia Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: A use after free issue was addressed with improved memory management. CVE-2026-86913: Meta Product Security Entry added October 19, 2026 ### CoreMotion Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to access motion data from headphones without user consent Description: An authorization issue was addressed with improved validation. CVE-2026-43737: Stuart Wallace ### CoreText Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-84596: ret2happy, Meta Product Security ### CoreUI Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re) ### CoreUI Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted image may lead to unexpected app termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-84571: stratan (@5tratan), Peter Malone ### CoreUI Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted asset catalog may lead to unexpected process termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84511: Rahul Raj, stratan (@5tratan) ### DeviceCheck Available for: A --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_