Live › vulnerability › CVE-2026-86886
This Apple advisory lists the security fixes shipped in iOS 26.7 and iPadOS 26.7, released September 14, 2026, across components such as Accelerate, Bluetooth, CoreMedia and the kernel-level APFS. The impacts range from app crashes and denial-of-service to sandbox bypasses, reading sensitive data and, in some entries, arbitrary code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 00:35 UTC, 0h before NVD. All times on this page are UTC.
The advisory covers iPhone 11 and later and the listed iPad models, running iOS 26.7 or iPadOS 26.7 or earlier builds. Devices that stay on an older build keep the unpatched components. Which entries apply to a given device depends on the hardware listed per component.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apple ipados | vendor | < 26.7 | 26.7 |
| apple iphone os | vendor | < 26.7 | 26.7 |
| apple watchos | vendor | < 27.0 | 27.0 |
26.7.26.7 per the advisory title; the sources do not describe other fixed versions.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
About the security content of iOS 26.7 and iPadOS 26.7 - Apple Support
This document describes the security content of iOS 26.7 and iPadOS 26.7.
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
Released September 14, 2026
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: Processing a maliciously crafted image may lead to unexpected process termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-86882: Peter Malone
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43664: Stuart Wallace, Rosyna Keller of Totally Not Malicious Software, Jian Lee (@speedyfriend433), Ilya Andr (andrd3v), Gongyu Ma (@Mezone0), David Strnadel, Daniel Febrero, CJ Vana, Asaf Cohen
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to cause unexpected system termination or write kernel memory
Description: An out-of-bounds write issue was addressed with improved bounds checking.
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input validation.
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory management.
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: Mounting a disk image with maliciously crafted files may lead to unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional restrictions.
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved checks.
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory handling.
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: A sandboxed app may be able to execute arbitrary code with kernel privileges
Description: A race condition was addressed with improved state management.
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved validation.
Available for: iPhone 11 and later
Impact: An attacker in a privileged network position may be able to cause a denial-of-service
Description: A denial-of-service issue was addressed with improved input validation.
Entry added October 19, 2026
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: A remote attacker may be able to cause unexpected app termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved bounds checking.
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An attacker in radio range may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
Entry added October 19, 2026
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An archive may be able to bypass Gatekeeper
Description: A file quarantine bypass was addressed with additional checks.
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: An attacker with a paired Bluetooth device may be able to execute arbitrary code
Description: A stack overflow was addressed with improved input validation.
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory
Description: An out-of-bounds access issue was addressed with improved bounds checking.
CVE-2026-113912: an anonymous researcher, 章鱼哥@aipy (aipyaipy.com), Roman Zabicki, Anna Groza (@pwnlambda) of Calif.io
Entry added October 26, 2026
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st
This page as .md · .json · in your agent: get_signal("CVE-2026-86886")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.