--- id: "CVE-2026-84624" kind: "vulnerability" aliases: ["CVE-2026-84624"] title: "A permissions issue was addressed with improved path validation" severity: "medium" cvss: 5.5 epss: null exploited: false status: "open" category: "infrastructure" products: [{"name": "apple ipados", "fixed": ["26.7"], "affected": "< 26.7", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["26.7"], "affected": "< 26.7", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["15.8"], "affected": ">= 15.0, < 15.8", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["26.7"], "affected": ">= 26.0, < 26.7", "ecosystem": "vendor"}, {"name": "apple visionos", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "infrastructure", "ios", "ipad", "ipados", "iphone", "vendor-advisory"] not_affected_if: ["already-updated"] published_at: "2026-09-14T21:17:37+00:00" first_seen_at: "2026-10-31T00:35:04+00:00" updated_at: "2026-10-31T01:03:58+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/149041", "first_seen_at": "2026-10-31T00:35:04+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84624", "first_seen_at": "2026-10-31T01:03:58+00:00"}] --- # A permissions issue was addressed with improved path validation Apple's iOS 26.7 and iPadOS 26.7 update fixes a permissions flaw in the CoreML component that let a sandboxed app access restricted files. An attacker who gets a malicious app onto the device can read files it should not be able to reach. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:apple ipados affected < 26.7 fixed 26.7 - vendor:apple iphone os affected < 26.7 fixed 26.7 - vendor:apple macos affected >= 15.0, < 15.8 fixed 15.8 - vendor:apple macos affected >= 26.0, < 26.7 fixed 26.7 - vendor:apple visionos affected < 27.0 fixed 27.0 ## How to check - Check the device version in Settings > General > About; affected versions are below `iOS 26.7` and `iPadOS 26.7`. - Confirm the entry for CVE-2026-84624 (CoreML) in Apple's advisory at https://support.apple.com/en-us/149041. ## Fix - iOS: upgrade to `iOS 26.7` - iPadOS: upgrade to `iPadOS 26.7` ## Timeline - 2026-10-31T00:35:04+00:00 lab https://support.apple.com/en-us/149041 — Apple: About the security content of iOS 26.7 and iPadOS 26.7 - Apple Support - 2026-10-31T01:03:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-84624 ## Documents - [advisory] Apple: About the security content of iOS 26.7 and iPadOS 26.7 - Apple Support https://support.apple.com/en-us/149041 - [advisory] Apple: About the security content of iOS 27 and iPadOS 27 - Apple Support https://support.apple.com/en-us/149034 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/149035 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/149038 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/149042 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/149043 ## From the sources About the security content of iOS 26.7 and iPadOS 26.7 - Apple Support # About the security content of iOS 26.7 and iPadOS 26.7 This document describes the security content of iOS 26.7 and iPadOS 26.7. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## iOS 26.7 and iPadOS 26.7 Released September 14, 2026 ### Accelerate Framework Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted image may lead to unexpected process termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86882: Peter Malone ### Accessibility Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43664: Stuart Wallace, Rosyna Keller of Totally Not Malicious Software, Jian Lee (@speedyfriend433), Ilya Andr (andrd3v), Gongyu Ma (@Mezone0), David Strnadel, Daniel Febrero, CJ Vana, Asaf Cohen ### APFS Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. ### Apple Neural Engine Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. ### AppleAVD Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. ### AppleDouble Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Mounting a disk image with maliciously crafted files may lead to unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. ### AuthKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A local app may be able to read a persistent account identifier Description: A permissions issue was addressed with additional restrictions. ### AVEVideoEncoder Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: The issue was addressed with improved checks. ### AVEVideoEncoder Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: A type confusion issue was addressed with improved memory handling. ### AVEVideoEncoder Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A sandboxed app may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved state management. ### BackgroundAssets Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: A logic issue was addressed with improved validation. ### Baseband Available for: iPhone 11 and later Impact: An attacker in a privileged network position may be able to cause a denial-of-service Description: A denial-of-service issue was addressed with improved input validation. Entry added October 19, 2026 ### Bluetooth Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A remote attacker may be able to cause unexpected app termination or arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. ### Bluetooth Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An attacker in radio range may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. Entry added October 19, 2026 ### copyfile Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An archive may be able to bypass Gatekeeper Description: A file quarantine bypass was addressed with additional checks. ### Core Bluetooth Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An attacker with a paired Bluetooth device may be able to execute arbitrary code Description: A stack overflow was addressed with improved input validation. ### CoreAudio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-113912: an anonymous researcher, 章鱼哥@aipy (aipyaipy.com), Roman Zabicki, Anna Groza (@pwnlambda) of Calif.io Entry added October 26, 2026 ### CoreMedia Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_