{"id":"CVE-2026-86887","kind":"vulnerability","aliases":["CVE-2026-86887"],"related":[],"title":"A privacy issue was addressed by removing sensitive data","description":"About the security content of visionOS 27 - Apple Support\n\n# About the security content of visionOS 27\n\nThis document describes the security content of visionOS 27.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## visionOS 27\n\nReleased September 14, 2026\n\n### Accelerate Framework\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted image may lead to unexpected process termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86882: Peter Malone\n\n### Accelerate Framework\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86918: Arni Hardarson (Neonix Security)\n\nEntry added October 19, 2026\n\n### APFS\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\n### App Intents\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A privacy issue was addressed with improved access restrictions.\n\nCVE-2026-84582: Zhongcheng Li (CK01)\n\nEntry added October 19, 2026\n\n### App Store\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A local app may be able to read a persistent account identifier\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86888: Zhongcheng Li (CK01)\n\n### Apple Account\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2026-20683: Dem0ns (@天府简易信工作室), Abdelhak Kherroubi, Jasminder Pal Singh, Lehan Dilusha Jayasingha (Sri Lanka)\n\n### Apple Intelligence\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-86920: Johan Wahyudi\n\nEntry added October 26, 2026\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-84634: S. Rosario\n\nEntry added October 26, 2026\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84595: tamdao\n\nEntry added October 26, 2026\n\n### AppleAVD\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\n### Audio\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to leak sensitive user information\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin\n\n### Authentication Services\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to delete credentials stored in Keychain\n\nDescription: This issue was addressed by removing the vulnerable code.\n\nCVE-2026-86905: Ilya Andr (andrd3v)\n\n### AuthKit\n\nImpact: A local app may be able to read a persistent account identifier\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\n### AVEVideoEncoder\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-65410: Calif.io in collaboration with Claude and Anthropic Research\n\n### AVEVideoEncoder\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-84616: Peter Malone\n\n### AVEVideoEncoder\n\nImpact: A sandboxed app may be able to execute arbitrary code with kernel privileges\n\nDescription: A race condition was addressed with improved state management.\n\nCVE-2026-84607: Ruslan Dautov\n\n### BackgroundAssets\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\n### Bluetooth\n\nImpact: A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### Bluetooth\n\nImpact: An app may gain unauthorized access to Bluetooth\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-84560: an anonymous researcher\n\n### Bluetooth\n\nImpact: An attacker in radio range may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84613: jioundai\n\nEntry added October 19, 2026\n\n### CloudKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A local app may be able to read a persistent account identifier\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nCVE-2026-86895: Stanislav Jelezoglo\n\n### CloudKit\n\nImpact: An app may be able to read device name\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86893: Heiner Gerdes\n\n### copyfile\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An archive may be able to bypass Gatekeeper\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola, an anonymous researcher\n\n### copyfile\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to modify protected parts of the file system\n\nCVE-2026-86966: Jihwan Yoon\n\nEntry added October 26, 2026\n\n### Core Bluetooth\n\nImpact: An attacker with a paired Bluetooth device may be able to execute arbitrary code\n\nDescription: A stack overflow was addressed with improved input validation.\n\nCVE-2026-86919: Mathis Mansière\n\nEntry added October 19, 2026\n\n### Core Bluetooth\n\nImpact: Processing a maliciously crafted Bluetooth packet may result in disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112608: Duc Anh Nguyen & Ta Duc Thien\n\nEntry added October 26, 2026\n\n### CoreMedia\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed by removing the vulnerable code.\n\nCVE-2026-64752: Nik Tsytsarkin\n\n### CoreMedia\n\nImpact: A sandboxed process may be able to circumvent sandbox restrictions\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86876: Chris Bailey - Short Circuit\n\n### CoreMedia\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-65344: Siyeong kim\n\n### CoreMedia\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-86913: Meta Product Security\n\nEntry added October 19, 2026\n\n### CoreML\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A sandboxed app may be able to access restricted files\n\nDescription: A permissions issue was addressed with improved path validation.\n\nCVE-2026-84624: AL Najafi, tamdao\n\n### CoreText\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing web content may lead to a denial-of-service\n\nDescription: A null pointer dereference was addressed with improved input validation.\n\nCVE-2026-65412: Pavan Nallamothu\n\n### CoreText\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-84596: ret2happy, Meta Product Security\n\n### CoreUI\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\n### CoreUI\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-84571: stratan (@5tratan), Peter Malone\n\n### CoreUI\n\nImpact: Processing a maliciously crafted asset catalog may lead to unexpected process termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84511: Rahul Raj, stratan (@5tratan)\n\n### DeviceCheck\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to read persistent device identifiers\n\nDescription: An authorization issue was addressed with improved access control.\n\nCVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill (@jjtech@infosec.exchange)\n\n### File Bookmark\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to modify a file it only had permission to read\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya Kumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)\n\n### file_cmds\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n\nDescription: A path handling issue was addressed with improved validation.\n\nCVE-2026-84534: Geoffrey Lovelace\n\n### FontParser\n\nImpact: Processing a maliciously crafted font file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-84524: an anonymous researcher\n\n### FontParser\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read issue was addressed with improved input validation.\n\nCVE-2026-84597: Nik Tsytsarkin\n\n### Foundation\n\nImpact: An app may be able to cause a denial of service\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research\n\n### Graphics\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg), Jiyong Yang\n\n### Heimdal\n\nCVE-2026-86942: He Wei (ギカク)\n\nEntry added October 26, 2026\n\n### iCloud\n\nImpact: An app may be able to identify a user across reinstalls\n\nCVE-2026-84606: Ilya Andr (andrd3v)\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may result in disclosure of process memory\n\nDescription: An uninitialized memory is","summary":"Apple's advisory for visionOS 27 lists many fixed security issues, mostly memory corruption and privacy or permission bugs in system components. The excerpt covers CVE-2026-86887 only as the advisory's own identifier and does not describe this CVE's specific flaw.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"apple ipados","fixed":["26.7"],"affected":"< 26.7","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["26.7"],"affected":"< 26.7","ecosystem":"vendor"},{"name":"apple visionos","fixed":["27.0"],"affected":"< 27.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","apple-vision-pro","vendor","vendor-advisory","visionos"],"not_affected_if":["other-apple-platforms"],"how_to_check":"- Check the installed visionOS version in Settings > General > About, and compare it with the release listed in the advisory.","fix":"- visionOS 27 (released September 14, 2026) carries the listed fixes; the exact fixed version for this CVE is unknown from the sources.","status":"open","published_at":"2026-09-14T21:17:39+00:00","first_seen_at":"2026-11-10T00:17:04+00:00","triaged_at":"2026-11-10T00:17:28+00:00","updated_at":"2026-11-10T00:28:45+00:00","category":"vendor","confidence":0.3,"triage":{"at":"2026-11-10T00:17:28Z","model":"claude-haiku-5-5","output":{"fix":"- visionOS 27 (released September 14, 2026) carries the listed fixes; the exact fixed version for this CVE is unknown from the sources.","reach":"unknown","title":"Apple visionOS 27: security advisory lists many CVEs, including memory and privacy flaws","impact":"medium","summary":"Apple's advisory for visionOS 27 lists many fixed security issues, mostly memory corruption and privacy or permission bugs in system components. The excerpt covers CVE-2026-86887 only as the advisory's own identifier and does not describe this CVE's specific flaw.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["visionos","apple-vision-pro"],"confidence":0.3,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Open https://support.apple.com/en-us/149038 and find the entry for CVE-2026-86887 to get its component, impact and credit.","how_to_check":"- Check the installed visionOS version in Settings > General > About, and compare it with the release listed in the advisory.","plain_action":"Update your Apple Vision Pro to visionOS 27 through Settings > General > Software Update.","product_name":"","needs_analyst":true,"not_affected_if":["other-apple-platforms"],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001152,"input_tokens":8935,"output_tokens":516,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A,59B,204C,244C,293C,332C,374C,421C,466C,503C,541C,581C,617C,661C '-20683':422C '-65339':618C '-65407':582C '-84523':294C '-84582':333C '-84595':542C '-84634':504C '-86882':205C '-86887':12A,15A,60B '-86888':375C '-86905':662C '-86918':245C '-86920':467C '14':166C '19':253C,340C '2026':167C,254C,341C,474C,511C,548C '26':473C,510C,547C '27':38B,83C,92C,101C,163C 'abdelhak':425C 'abl':268C,315C,357C,393C,449C,483C,520C,562C,601C,643C 'acceler':168C,208C 'access':317C,329C,404C,451C 'account':362C,380C,409C 'add':251C,338C,471C,508C,545C 'addit':371C,500C 'address':5A,198C,238C,287C,326C,369C,415C,460C,498C,535C,575C,612C,654C 'advisori':31B,35B,64B 'andr':664C 'andrd3v':665C 'anonym':299C 'apf':255C 'app':227C,265C,301C,312C,342C,354C,390C,446C,480C,517C,559C,598C,640C,670C 'appl':23B,25B,33B,84C,103C,110C,136C,140C,158C,172C,212C,258C,305C,346C,379C,383C,400C,408C,435C,439C,475C,512C,552C,591C,633C 'apple':16A,18A,21A 'apple-vision-pro':24B 'appleavd':549C 'arni':246C 'audio':588C 'authent':401C,412C,629C 'authkit':666C 'author':457C 'avail':129C,170C,210C,256C,303C,344C,381C,437C,550C,589C,631C 'belman':584C 'blackw':586C 'bound':194C,201C,234C,241C,283C,290C,531C,538C 'bug':51B 'calap':620C 'caus':270C,485C,522C,564C 'cem':295C 'check':202C,242C,291C,539C,615C 'ck01':336C,378C 'code':659C 'compon':54B 'condit':496C 'confirm':116C 'content':80C,89C,98C 'corrupt':46B 'cover':57B 'craft':181C,221C 'credenti':646C 'custom':108C 'cve':10A,13A,58B,73B,147C,203C,243C,292C,331C,373C,420C,465C,502C,540C,580C,616C,660C 'cve-id':146C 'data':9A,320C,454C 'dbg.re':622C 'delet':645C 'dem0ns':423C 'describ':71B,95C 'descript':189C,229C,278C,321C,364C,410C,455C,493C,526C,568C,607C,650C 'dilusha':431C 'disclos':113C 'discuss':114C 'document':94C,142C 'doesn':111C 'engin':477C,514C 'entri':250C,337C,470C,507C,544C 'excerpt':56B 'fix':41B 'flaw':76B 'flow':402C 'framework':169C,209C 'franco':583C 'free':572C 'hardarson':247C 'id':148C 'identifi':67B,363C 'ilya':663C 'imag':182C,222C 'impact':177C,217C,263C,310C,351C,388C,444C,478C,515C,557C,596C,638C,667C 'improv':200C,240C,289C,328C,417C,462C,537C,577C,614C 'inform':153C,606C 'intellig':436C,587C 'intent':302C 'investig':121C 'ipados':17A 'iphone':19A 'issu':3A,43B,118C,196C,236C,285C,324C,367C,413C,458C,533C,573C,610C,652C 'jasmind':427C 'jayasingha':432C 'johan':468C 'karagun':297C 'kernel':276C,491C 'keychain':649C 'kherroubi':426C 'lanka':434C 'lead':184C,224C 'leak':603C 'lehan':430C 'li':335C,377C 'list':39B,133C 'local':353C,669C 'logic':609C 'ma':671C 'malici':180C,220C 'malon':207C 'manag':419C,464C,579C 'mani':40B 'may':183C,223C,266C,313C,355C,391C,447C,481C,518C,560C,599C,641C 'memori':45B,277C,492C,578C 'meta':623C 'model':176C,216C,262C,309C,350C,387C,443C,556C,595C,637C 'most':44B 'mustafa':619C 'neonix':248C 'neural':476C,513C 'nik':627C 'occur':123C 'octob':252C,339C,472C,509C,546C 'onat':296C 'ordinal0':621C 'os':20A 'out-of-bound':191C,231C,280C,528C 'page':139C,161C 'pal':428C 'patch':125C 'permiss':50B,366C 'persist':361C 'peter':206C 'possibl':150C 'privaci':2A,48B,323C 'pro':27B,174C,214C,260C,307C,348C,385C,441C,554C,593C,635C 'process':178C,187C,218C 'product':159C 'protect':109C 'race':495C 'read':359C 'recent':130C 'red':624C 'refer':143C 'releas':127C,131C,138C,164C 'remov':7A,656C 'research':300C 'restrict':330C,372C 'rosario':506C 'secur':42B,79C,88C,97C,104C,117C,137C,141C,155C,160C,249C 'see':156C 'sensit':8A,318C,452C,604C 'septemb':165C 'servic':630C 'sign':397C 'singh':429C 'specif':75B 'sri':433C 'state':418C,463C 'store':343C,647C 'support':85C 'system':53B,272C,487C,524C,566C 'tamdao':543C 'team':625C 'termin':188C,228C,273C,488C,525C,567C 'tsytsarkin':628C 'unexpect':186C,226C,271C,486C,523C,565C 'updat':105C 'use':395C,570C 'user':319C,406C,453C,605C 'valid':501C 'vendor':28B,30B 'vendor-advisori':29B 'vision':26B,173C,213C,259C,306C,347C,384C,440C,553C,592C,634C 'visiono':32B,37B,82C,91C,100C,162C 'visionos':22A 'vulner':144C,658C 'wahyudi':469C 'write':195C,235C,275C,284C,490C,532C 'x':626C 'zhongcheng':334C,376C '天府简易信工作室':424C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Apple Vision Pro to visionOS 27 through Settings > General > Software Update.","pkeys":["appleipados","appleiphoneos","applevisionos","ipados","iphoneos","visionos"],"ptokens":["apple","ipados","iphone","os","visionos"],"labels":["apple","applevisionpro","low","vendor","vendoradvisory","visionos"],"campaign_type":null,"search_a":"'-2026':11A,14A '-86887':12A,15A 'address':5A 'apple':16A,18A,21A 'cve':10A,13A 'data':9A 'ipados':17A 'iphone':19A 'issu':3A 'os':20A 'privaci':2A 'remov':7A 'sensit':8A 'visionos':22A","search_b":"'-2026':59B '-86887':60B '27':38B 'advisori':31B,35B,64B 'appl':23B,25B,33B 'apple-vision-pro':24B 'bug':51B 'compon':54B 'corrupt':46B 'cover':57B 'cve':58B,73B 'describ':71B 'excerpt':56B 'fix':41B 'flaw':76B 'identifi':67B 'issu':43B 'list':39B 'mani':40B 'memori':45B 'most':44B 'permiss':50B 'privaci':48B 'pro':27B 'secur':42B 'specif':75B 'system':53B 'vendor':28B,30B 'vendor-advisori':29B 'vision':26B 'visiono':32B,37B","search_c":"'-2026':204C,244C,293C,332C,374C,421C,466C,503C,541C,581C,617C,661C '-20683':422C '-65339':618C '-65407':582C '-84523':294C '-84582':333C '-84595':542C '-84634':504C '-86882':205C '-86888':375C '-86905':662C '-86918':245C '-86920':467C '14':166C '19':253C,340C '2026':167C,254C,341C,474C,511C,548C '26':473C,510C,547C '27':83C,92C,101C,163C 'abdelhak':425C 'abl':268C,315C,357C,393C,449C,483C,520C,562C,601C,643C 'acceler':168C,208C 'access':317C,329C,404C,451C 'account':362C,380C,409C 'add':251C,338C,471C,508C,545C 'addit':371C,500C 'address':198C,238C,287C,326C,369C,415C,460C,498C,535C,575C,612C,654C 'andr':664C 'andrd3v':665C 'anonym':299C 'apf':255C 'app':227C,265C,301C,312C,342C,354C,390C,446C,480C,517C,559C,598C,640C,670C 'appl':84C,103C,110C,136C,140C,158C,172C,212C,258C,305C,346C,379C,383C,400C,408C,435C,439C,475C,512C,552C,591C,633C 'appleavd':549C 'arni':246C 'audio':588C 'authent':401C,412C,629C 'authkit':666C 'author':457C 'avail':129C,170C,210C,256C,303C,344C,381C,437C,550C,589C,631C 'belman':584C 'blackw':586C 'bound':194C,201C,234C,241C,283C,290C,531C,538C 'calap':620C 'caus':270C,485C,522C,564C 'cem':295C 'check':202C,242C,291C,539C,615C 'ck01':336C,378C 'code':659C 'condit':496C 'confirm':116C 'content':80C,89C,98C 'craft':181C,221C 'credenti':646C 'custom':108C 'cve':147C,203C,243C,292C,331C,373C,420C,465C,502C,540C,580C,616C,660C 'cve-id':146C 'data':320C,454C 'dbg.re':622C 'delet':645C 'dem0ns':423C 'describ':95C 'descript':189C,229C,278C,321C,364C,410C,455C,493C,526C,568C,607C,650C 'dilusha':431C 'disclos':113C 'discuss':114C 'document':94C,142C 'doesn':111C 'engin':477C,514C 'entri':250C,337C,470C,507C,544C 'flow':402C 'framework':169C,209C 'franco':583C 'free':572C 'hardarson':247C 'id':148C 'identifi':363C 'ilya':663C 'imag':182C,222C 'impact':177C,217C,263C,310C,351C,388C,444C,478C,515C,557C,596C,638C,667C 'improv':200C,240C,289C,328C,417C,462C,537C,577C,614C 'inform':153C,606C 'intellig':436C,587C 'intent':302C 'investig':121C 'issu':118C,196C,236C,285C,324C,367C,413C,458C,533C,573C,610C,652C 'jasmind':427C 'jayasingha':432C 'johan':468C 'karagun':297C 'kernel':276C,491C 'keychain':649C 'kherroubi':426C 'lanka':434C 'lead':184C,224C 'leak':603C 'lehan':430C 'li':335C,377C 'list':133C 'local':353C,669C 'logic':609C 'ma':671C 'malici':180C,220C 'malon':207C 'manag':419C,464C,579C 'may':183C,223C,266C,313C,355C,391C,447C,481C,518C,560C,599C,641C 'memori':277C,492C,578C 'meta':623C 'model':176C,216C,262C,309C,350C,387C,443C,556C,595C,637C 'mustafa':619C 'neonix':248C 'neural':476C,513C 'nik':627C 'occur':123C 'octob':252C,339C,472C,509C,546C 'onat':296C 'ordinal0':621C 'out-of-bound':191C,231C,280C,528C 'page':139C,161C 'pal':428C 'patch':125C 'permiss':366C 'persist':361C 'peter':206C 'possibl':150C 'privaci':323C 'pro':174C,214C,260C,307C,348C,385C,441C,554C,593C,635C 'process':178C,187C,218C 'product':159C 'protect':109C 'race':495C 'read':359C 'recent':130C 'red':624C 'refer':143C 'releas':127C,131C,138C,164C 'remov':656C 'research':300C 'restrict':330C,372C 'rosario':506C 'secur':79C,88C,97C,104C,117C,137C,141C,155C,160C,249C 'see':156C 'sensit':318C,452C,604C 'septemb':165C 'servic':630C 'sign':397C 'singh':429C 'sri':433C 'state':418C,463C 'store':343C,647C 'support':85C 'system':272C,487C,524C,566C 'tamdao':543C 'team':625C 'termin':188C,228C,273C,488C,525C,567C 'tsytsarkin':628C 'unexpect':186C,226C,271C,486C,523C,565C 'updat':105C 'use':395C,570C 'user':319C,406C,453C,605C 'valid':501C 'vision':173C,213C,259C,306C,347C,384C,440C,553C,592C,634C 'visiono':82C,91C,100C,162C 'vulner':144C,658C 'wahyudi':469C 'write':195C,235C,275C,284C,490C,532C 'x':626C 'zhongcheng':334C,376C '天府简易信工作室':424C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-14T21:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"lab","external_id":"https://support.apple.com/en-us/149038#CVE-2026-86887","url":"https://support.apple.com/en-us/149038","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-10T00:17:04+00:00","fetched_at":"2026-11-10T00:17:04+00:00","note":"Apple: About the security content of visionOS 27 - Apple Support"},{"source":"nvd","external_id":"CVE-2026-86887","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86887","severity":null,"published_at":"2026-09-14T21:17:39+00:00","modified_at":"2026-09-21T18:03:25+00:00","first_seen_at":"2026-11-10T00:28:45+00:00","fetched_at":"2026-11-10T00:28:45+00:00","note":null}],"documents":[{"id":27527,"url":"https://support.apple.com/en-us/149038","title":"Apple: About the security content of visionOS 27 - Apple Support","kind":"vendor","source":"nvd","publisher":"vendor","text":"About the security content of visionOS 27 - Apple Support\n\n# About the security content of visionOS 27\n\nThis document describes the security content of visionOS 27.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## visionOS 27\n\nReleased September 14, 2026\n\n### Accelerate Framework\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted image may lead to unexpected process termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86882: Peter Malone\n\n### Accelerate Framework\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86918: Arni Hardarson (Neonix Security)\n\nEntry added October 19, 2026\n\n### APFS\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\n### App Intents\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A privacy issue was addressed with improved access restrictions.\n\nCVE-2026-84582: Zhongcheng Li (CK01)\n\nEntry added October 19, 2026\n\n### App Store\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A local app may be able to read a persistent account identifier\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86888: Zhongcheng Li (CK01)\n\n### Apple Account\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2026-20683: Dem0ns (@天府简易信工作室), Abdelhak Kherroubi, Jasminder Pal Singh, Lehan Dilusha Jayasingha (Sri Lanka)\n\n### Apple Intelligence\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-86920: Johan Wahyudi\n\nEntry added October 26, 2026\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-84634: S. Rosario\n\nEntry added October 26, 2026\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84595: tamdao\n\nEntry added October 26, 2026\n\n### AppleAVD\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\n### Audio\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to leak sensitive user information\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin\n\n### Authentication Services\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to delete credentials stored in Keychain\n\nDescription: This issue was addressed by removing the vulnerable code.\n\nCVE-2026-86905: Ilya Andr (andrd3v)\n\n### AuthKit\n\nImpact: A local app may be able to read a persistent account identifier\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\n### AVEVideoEncoder\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-65410: Calif.io in collaboration with Claude and Anthropic Research\n\n### AVEVideoEncoder\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-84616: Peter Malone\n\n### AVEVideoEncoder\n\nImpact: A sandboxed app may be able to execute arbitrary code with kernel privileges\n\nDescription: A race condition was addressed with improved state management.\n\nCVE-2026-84607: Ruslan Dautov\n\n### BackgroundAssets\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\n### Bluetooth\n\nImpact: A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### Bluetooth\n\nImpact: An app may gain unauthorized access to Bluetooth\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-84560: an anonymous researcher\n\n### Bluetooth\n\nImpact: An attacker in radio range may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84613: jioundai\n\nEntry added October 19, 2026\n\n### CloudKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A local app may be able to read a persistent account identifier\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nCVE-2026-86895: Stanislav Jelezoglo\n\n### CloudKit\n\nImpact: An app may be able to read device name\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86893: Heiner Gerdes\n\n### copyfile\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An archive may be able to bypass Gatekeeper\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola, an anonymous researcher\n\n### copyfile\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to modify protected parts of the file system\n\nCVE-2026-86966: Jihwan Yoon\n\nEntry added October 26, 2026\n\n### Core Bluetooth\n\nImpact: An attacker with a paired Bluetooth device may be able to execute arbitrary code\n\nDescription: A stack overflow was addressed with improved input validation.\n\nCVE-2026-86919: Mathis Mansière\n\nEntry added October 19, 2026\n\n### Core Bluetooth\n\nImpact: Processing a maliciously crafted Bluetooth packet may result in disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112608: Duc Anh Nguyen & Ta Duc Thien\n\nEntry added October 26, 2026\n\n### CoreMedia\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed by removing the vulnerable code.\n\nCVE-2026-64752: Nik Tsytsarkin\n\n### CoreMedia\n\nImpact: A sandboxed process may be able to circumvent sandbox restrictions\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86876: Chris Bailey - Short Circuit\n\n### CoreMedia\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-65344: Siyeong kim\n\n### CoreMedia\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-86913: Meta Product Security\n\nEntry added October 19, 2026\n\n### CoreML\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A sandboxed app may be able to access restricted files\n\nDescription: A permissions issue was addressed with improved path validation.\n\nCVE-2026-84624: AL Najafi, tamdao\n\n### CoreText\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing web content may lead to a denial-of-service\n\nDescription: A null pointer dereference was addressed with improved input validation.\n\nCVE-2026-65412: Pavan Nallamothu\n\n### CoreText\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-84596: ret2happy, Meta Product Security\n\n### CoreUI\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\n### CoreUI\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-84571: stratan (@5tratan), Peter Malone\n\n### CoreUI\n\nImpact: Processing a maliciously crafted asset catalog may lead to unexpected process termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84511: Rahul Raj, stratan (@5tratan)\n\n### DeviceCheck\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to read persistent device identifiers\n\nDescription: An authorization issue was addressed with improved access control.\n\nCVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill (@jjtech@infosec.exchange)\n\n### File Bookmark\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to modify a file it only had permission to read\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya Kumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)\n\n### file_cmds\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n\nDescription: A path handling issue was addressed with improved validation.\n\nCVE-2026-84534: Geoffrey Lovelace\n\n### FontParser\n\nImpact: Processing a maliciously crafted font file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-84524: an anonymous researcher\n\n### FontParser\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read issue was addressed with improved input validation.\n\nCVE-2026-84597: Nik Tsytsarkin\n\n### Foundation\n\nImpact: An app may be able to cause a denial of service\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research\n\n### Graphics\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg), Jiyong Yang\n\n### Heimdal\n\nCVE-2026-86942: He Wei (ギカク)\n\nEntry added October 26, 2026\n\n### iCloud\n\nImpact: An app may be able to identify a user across reinstalls\n\nCVE-2026-84606: Ilya Andr (andrd3v)\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may result in disclosure of process memory\n\nDescription: An uninitialized memory issue was addressed with improved memory initialization.\n\nCVE-2026-84564: Justin O'Leary (@olearysec) of olearysec.com\n\nEntry updated October 19, 2026\n\n### ImageIO\n\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\n### ImageIO\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\n### ImageIO\n\nCVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to unexpected process termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-86975: Tommy DeVoss from Braze Security Team (@thedawgyg), an anonymous researcher\n\nEntry added October 19, 2026\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-86954: Mateusz Jurczyk of Google Project Zero\n\nEntry added October 26, 2026\n\n### IOGPUFamily\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64788: Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi\n\nEntry updated October 19, 2026\n\n### IOKit\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, 이재영\n\n### IOMobileFrameBuffer\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0, dbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin\n\nCVE-2026-64736: Ruslan Dautov, hxr1\n\n### IOSurfaceAccelerator\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to leak sensitive kernel state\n\nDescription: An information leakage was addressed with additional validation.\n\nCVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing Intelligence\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-28968: genter0, Svetoslav Stolarov, Josh Maine of Calif.io, Dun\n\nEntry updated October 19, 2026\n\n### Kernel\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A local user may be able to cause unexpected system termination or read kernel memory\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-65415: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\n### Kernel\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-65349: an anonymous researcher\n\n### Kernel\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-84561: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Bhaswanth Chigurupati\n\n### Kernel\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-84630: Tristan Madani (@TristanInSec) from Talence Security\n\nCVE-2026-65360: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-65358: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-65377: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ye Zhang (@VAR10CK) of Baidu Security\n\n### Kernel\n\nImpact: An app with root privileges may be able to read uninitialized kernel memory\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-84622: Hiroki Imai (LAC Co., Ltd.)\n\n### Kernel\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-43689: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Kernel\n\nImpact: Connecting to a malicious NFS server may disclose kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43687: R4mbb of KRsecurity, Peter Malone\n\n### Kernel\n\nImpact: Connecting to a malicious NFS server may lead to kernel memory corruption\n\nCVE-2026-43686: Peter Malone\n\n### Kernel\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-65405: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nCVE-2026-84530: Vladislav Shevchenko (Positive Technologies)\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-84521: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-65402: Fábio Luís @scanpt, Richard Zana, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: A local user may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-65359: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-84507: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-86903: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-65330: Ashish Kunwar, Mikhail Lozhnikov of Positive Technologies, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Bhaswanth Chigurupati\n\nCVE-2026-28935: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-84599: an anonymous researcher\n\nEntry updated October 26, 2026\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved checks.\n\nCVE-2026-84602: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-86962: OpenAI, Hüseyin Kabasakal @HuseyinK01\n\nEntry added October 19, 2026\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-86964: Ryan Hileman via Xint Code (xint.io)\n\nEntry added October 26, 2026\n\n### libarchive\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: A heap buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-86870: Kitten Food\n\n### Managed Configuration\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A privacy issue was addressed with improved handling of files.\n\nCVE-2026-86883: Sindre Sorhus, Morris Richman (@morrisinlife), Stuart Wallace, Tristan Brennan\n\n### MediaRemote\n\nImpact: A sandboxed app may be able to access the System Keychain\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-84628: Myeonghun Pak, Nathaniel Oh (@calysteon), Alan Banderas (@creeper4004)\n\n### MobileBackup\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: A path handling issue was addressed with improved validation.\n\nCVE-2026-65411: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\n### Model I/O\n\nImpact: Opening a maliciously crafted file may lead to unexpected process termination\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-84497: Yiğit Can YILMAZ (@yilmazcanyigit)\n\n### Music\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-84615: Stanislav Jelezoglo\n\n### NetworkExtension\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-43695: Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### NetworkExtension\n\nImpact: An app may be able to identify what other apps a user has installed\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nCVE-2026-84626: Hoffcona of IES Red Team\n\nEntry updated October 19, 2026\n\n### Photos Storage\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-84491: an anonymous researcher\n\n### Photos Storage\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to fingerprint the user\n\nDescription: This issue was addressed with additional entitlement checks.\n\nCVE-2026-84629: Stanislav Jelezoglo\n\n### RawCamera\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted image may lead to heap corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-84627: Mateusz Jurczyk of Google Project Zero, Piotr Jerzy Duszynski, f0r of MurphySec, PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj, ธนกฤต ทัฬหะ\n\nEntry added October 26, 2026\n\n### RealityKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-28966: stratan (@5tratan)\n\n### RealityKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n\nDescription: An out-of-bounds read issue was addressed with improved input validation.\n\nCVE-2026-84532: Franco Belman at Blackwing Intelligence, Hongsik Kim (mnur), stratan (@5tratan)\n\nEntry updated October 26, 2026\n\n### Reminders\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-65403: Rahul Raj\n\n### Safe Browsing\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with additional entitlement checks.\n\nCVE-2026-86897: Stuart Wallace\n\n### Sandbox\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to bypass network restrictions\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2026-84551: Issa Sancho\n\n### Sandbox Profiles\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to fingerprint the user\n\nDescription: A permissions issue was addressed with additional sandbox restrictions.\n\nCVE-2026-84625: Ilya Andr (andrd3v) of Positive Technologies, CJ Vana\n\n### Sandbox Profiles\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-84603: Gongyu Ma (@Mezone0), CJ Vana, Stanislav Jelezoglo\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may result in disclosure of process memory\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-84487: stratan (@5tratan), Dhiyanesh Selvaraj (@redroot97), Peter Malone\n\n### SceneKit\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-84632: Peter Malone\n\n### SceneKit\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-84620: Peter Malone\n\n### SceneKit\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nCVE-2026-84546: Narendra Singh (@_3P1C), stratan (@5tratan), Peter Malone\n\nCVE-2026-84611: Nathaniel Oh (@calysteon)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted 3D scene may lead to unexpected process termination\n\nCVE-2026-84526: stratan (@5tratan)\n\n### Security\n\nImpact: An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n\nCVE-2026-86881: Surya Narayan Kushwaha, Roman Zabicki, John Lussier, Filip Olszak\n\n### Security\n\nCVE-2026-84508: Abodi Dawoud, Merrick Hare, Roelof van Dijk\n\nEntry added October 19, 2026\n\n### Shortcuts\n\nImpact: A malicious shortcut may be able to send messages without user confirmation\n\nCVE-2026-84600: Owen Pawling (@owenpawling)\n\n### Shortcuts\n\nCVE-2026-28850: OSORI\n\nEntry added October 19, 2026\n\n### Siri\n\nImpact: A local attacker may be able to overwrite restricted files\n\nCVE-2026-86921: Jonghoon Han (Aegis), bubu, 이재영, Tae Woo Kim, Dawuge of Shuffle Team\n\nEntry added October 19, 2026\n\n### Software Update\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to modify protected system files\n\nDescription: A permissions issue was addressed with improved path validation.\n\nCVE-2026-84609: YingMuo (@YingMuo) of DEVCORE Research Team\n\n### SpringBoard\n\nImpact: An app may be able to cause a denial-of-service\n\nCVE-2026-86892: Lehan Dilusha Jayasingha\n\n### Symptom Framework\n\nImpact: A malicious application may be able to determine a user's current location\n\nCVE-2026-84513: Sindre Sorhus\n\n### TCC\n\nCVE-2026-84527: Zeyang Li&Yuxiang Wang of Chongqing Telecom\n\n### Time Zone\n\nImpact: An app may be able to bypass certain Privacy preferences\n\nCVE-2026-86887: an anonymous researcher\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process termination\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-84635: Souta Sugiyama\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43795: wwwlk\n\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 318405\n\nCVE-2026-65341: Henock Habte\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321480\n\nCVE-2026-64782: Charles Kern, Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may disclose sensitive user information\n\nDescription: A permissions issue was addressed by removing the vulnerable code.\n\nWebKit Bugzilla: 315121\n\nCVE-2026-64753: Viggo Lekdorf\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved input validation.\n\nWebKit Bugzilla: 321484\n\nCVE-2026-64781: Thomas Guillem\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: This issue was addressed through improved state management.\n\nWebKit Bugzilla: 321517\n\nCVE-2026-65351: Niels Hofmans\n\nWebKit Bugzilla: 316996\n\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo)\n\nWebKit Bugzilla: 317142\n\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317349\n\nCVE-2026-65336: Josef Korbel\n\nWebKit Bugzilla: 316723\n\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317603\n\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317450\n\nCVE-2026-65332: Kun Peeks (@SwayZGl1tZyyy), OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317611\n\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 316347\n\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313703\n\nCVE-2026-64787: 杉山 壮太, Shubham Chaskar\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved checks.\n\nWebKit Bugzilla: 316918\n\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nWebKit Bugzilla: 316791\n\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 317317\n\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\n### WebKit\n\nImpact: Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n\nDescription: A logic issue was addressed with improved state management.\n\nWebKit Bugzilla: 318271\n\nCVE-2026-86898: Tomi Garcia (archyxsec)\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: A type confusion issue was addressed with improved state management.\n\nWebKit Bugzilla: 308231\n\nCVE-2026-86922: Nathaniel Oh (@calysteon), Kwak Kiyong / kakaogames\n\nEntry added October 19, 2026\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to unexpected behavior\n\nDescription: A logic issue was addressed with improved state management.\n\nWebKit Bugzilla: 318807\n\nCVE-2026-86872: Junhyuk Im of S2W Inc, Seungyun Lee of S2W Inc\n\nEntry added October 19, 2026\n\n### WebKit Canvas\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313935\n\nCVE-2026-64718: Niels Hofmans, OGINOME Tomohito, an anonymous researcher\n\n### WebKit History\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Visiting a maliciously crafted website may leak sensitive data\n\nDescription: The issue was addressed with improved checks.\n\nWebKit Bugzilla: 322124\n\nCVE-2026-64778: Mohit Negi\n\n### WebKit Storage\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nCVE-2026-64779: Tommy DeVoss from Braze Security Team (@thedawgyg), Shubham Chaskar\n\n### WebRTC\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-65391: Myungyong Lee\n\n### WebRTC\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65390: Kwak Kiyong (@Pwnkai23), Song Nuri\n\n### Wi-Fi\n\nImpact: An attacker in physical proximity may be able to cause a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86953: Efstratios Kaplanellis (@5tratan) of Almamater Technologies, Jakob Pammer\n\nEntry added October 19, 2026, updated October 26, 2026\n\n### Wi-Fi\n\nImpact: An attacker in wireless proximity may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-86957: Drin Raci of sentry.security, Niels Hofmans\n\nEntry added October 19, 2026\n\n### Wi-Fi Connectivity\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-84636: Sindre Sorhus, Jian Lee (@speedyfriend433)\n\nEntry updated October 19, 2026\n\n## Additional recognition\n\n### Accounts\n\nWe would like to acknowledge Wojciech Regula of SecuRing (wojciechregula.blog) for their assistance.\n\n### Apple Intelligence\n\nWe would like to acknowledge an anonymous researcher for their assistance.\n\n### AppleKeyStore\n\nWe would like to acknowledge Abdurrahman Nafi, Francisco Knabe, Karol Mazurek (@Karmaz95) of AFINE, Somair Ansar, YOKI, an anonymous researcher, 晓娟 谢 for their assistance.\n\n### AVEVideoEncoder\n\nWe would like to acknowledge tamdao for their assistance.\n\n### Bluetooth\n\nWe would like to acknowledge Suresh Sundaram, Youssef Ahmed Saad for their assistance.\n\n### Calendar\n\nWe would like to acknowledge Dany Assuid, Jacob Hazak from Zero-Defense Labs, Varik Matevosyan, stratan (@5tratan) for their assistance.\n\n### CipherML\n\nWe would like to acknowledge Nils Hanff (@nils1729@chaos.social) of Hasso Plattner Institute for their assistance.\n\n### CloudKit\n\nWe would like to acknowledge Hikerell (Loadshine Lab) for their assistance.\n\n### Compression\n\nWe would like to acknowledge Tommy DeVoss from Braze Security Team (@thedawgyg) for their assistance.\n\n### copyfile\n\nWe would like to acknowledge Morris Richman (@morrisinlife) and Jian Lee (@speedyfriend433) for their assistance.\n\n### CoreAnimation\n\nWe would like to acknowledge Duy Trần (@khanhduytran0) for their assistance.\n\n### CoreAudio\n\nWe would like to acknowledge Patrick Saif / x.com/weezerOSINT / github.com/sai2fast for their assistance.\n\n### CoreBluetooth - LE\n\nWe would like to acknowledge Ashmit Sharma & Atul RV, Dun, Maliq Barnard, Nicholas C. of Onymos Inc. (onymos.com), Peter Malone, Robert M for their assistance.\n\n### CoreGraphics\n\nWe would like to acknowledge Gandalf4a of PKU-Changsha Institute for Computing and Digital Economy for their assistance.\n\n### CoreMedia\n\nWe would like to acknowledge Chris Bailey - Short Circuit for their assistance.\n\n### CoreText\n\nWe would like to acknowledge Jian Lee (@speedyfriend433) for their assistance.\n\n### CoreUI\n\nWe would like to acknowledge Peter Malone for their assistance.\n\n### DataAccess\n\nWe would like to acknowledge Adetayo Adebimpe (Cyboghostginx) for their assistance.\n\n### FaceTime\n\nWe would like to acknowledge Souhaib Naceri for their assistance.\n\n### Files\n\nWe would like to acknowledge an anonymous researcher for their assistance.\n\n### iCloud\n\nWe would like to acknowledge 3ndy1(@_3ndy1) and moyu for their assistance.\n\n### ImageIO\n\nWe would like to acknowledge Kun Peeks (@SwayZGl1tZyyy), Muhamad Syaiful, Ronen Seleri & Shahaf Pruss, an anonymous researcher, songbird for their assistance.\n\nEntry updated October 19, 2026\n\n### IOSurfaceAccelerator\n\nWe would like to acknowledge Chanwit Muenprakoddee (ChemIndy), Franco Belman at Blackwing Intelligence, Iain Harkiss, an anonymous researcher, beist, hxr1 for their assistance.\n\n### Kernel\n\nWe would like to acknowledge Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Cem Onat Karagun, James Duffy (@0x4A616D657344), Lyutoon, Nebula Security (@nebusecurity), Nicolas Seriot, Peter Malone, Redon Gashi of Sentry, Robert Tran, Xiang Li from AOSP Lab @Nankai University, Yongsong Yu, an anonymous researcher for their assistance.\n\nEntry updated October 26, 2026\n\n### LaunchServices\n\nWe would like to acknowledge Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) for their assistance.\n\n### mDNSResponder\n\nWe would like to acknowledge Anton Pakhunov, Franciszek Kalinowski (striga.ai / isec.pl), Hannes Weissteiner, Roland Czerny, Simone Franza, Stefan Gast and Daniel Gruss of Graz University of Technology, and Johanna Ullrich of the Interdisciplinary Transformation University (IT:U), Issa Sancho, Jian Zhou, 章鱼哥@aipy (aipyaipy.com), and Sindre Sorhusfor their assistance.\n\nEntry updated October 19, 2026\n\n### Notifications\n\nWe would like to acknowledge Abhay Kailasia (@abhay_kailasia) from Safran Mumbai India, Himanshu Bharti @Xpl0itme From Khatima, Jan Rokita (rokita.me) for their assistance.\n\n### Passwords\n\nWe would like to acknowledge Catalin Lita of Moralis, Christian Kohlschütter, David Coomber of Info-Sec.CA, Lukasz Tulikowski at Software Cloud, Sujay Amin, an anonymous researcher for their assistance.\n\n### Printing\n\nWe would like to acknowledge Stuart Wallace for their assistance.\n\n### Pro Res\n\nWe would like to acknowledge Meta Red Team X - Nik Tsytsarkin for their assistance.\n\n### RemoteServiceDiscovery\n\nWe would like to acknowledge Tristan Madani (@TristanInSec) from Talence Security, an anonymous researcher for their assistance.\n\n### Safari\n\nWe would like to acknowledge Dem0ns @天府简易信工作室 for their assistance.\n\n### Sandbox Profiles\n\nWe would like to acknowledge Lachlan Bauerochse for their assistance.\n\n### Security\n\nWe would like to acknowledge John Lussier, Roman Zabicki for their assistance.\n\nWe would like to acknowledge Atul Kishor Jaiswal, Benjamin Hornbeck for their assistance.\n\n### Shortcuts\n\nWe would like to acknowledge Csaba Fitzl (@theevilbit) of Iru, Owen Pawling (@owenpawling) for their assistance.\n\n### VoiceOver\n\nWe would like to acknowledge Hariji Vivek Pandey for their assistance.\n\n### WebKit\n\nWe would like to acknowledge @TristanInSec, Behzad Najjarpour Jabbari (@_G4ru_), Big Bear, Eddy Tsalolikhin, Henock Habte, Henock Habte, Kenneth Hsu, Maher Azzouzi, Meridian Miftari, OpenAI Codex Security - Amy Burnett, Souta Sugiyama, Vitaly Simonovich, an anonymous researcher, hamayanhamayan, lattice, lebr0nli of National Yang Ming Chiao Tung University, Security and Systems Lab, ret2happy, wwwlk, and Qadhafy Muhammad Tera for their assistance.\n\nEntry updated October 19, 2026\n\n### WebKit Canvas\n\nWe would like to acknowledge Utkarsh Pal for their assistance.\n\n### WebKit JavaScript Bindings\n\nWe would like to a","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":27322,"url":"https://support.apple.com/en-us/149034","title":"Apple: About the security content of iOS 27 and iPadOS 27 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of iOS 27 and iPadOS 27 - Apple Support\n\n# About the security content of iOS 27 and iPadOS 27\n\nThis document describes the security content of iOS 27 and iPadOS 27.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 27 and iPadOS 27\n\nReleased September 14, 2026\n\n### Accelerate Framework\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted image may lead to unexpected process termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86882: Peter Malone\n\n### Accelerate Framework\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86918: Arni Hardarson (Neonix Security)\n\nEntry added October 19, 2026\n\n### Accessibility\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with improved data protection.\n\nCVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of Totally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero, Asaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)\n\n### Accessibility\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to identify what other apps a user has installed\n\nDescription: A privacy issue was addressed with improved handling of user preferences.\n\nCVE-2026-64761: Stuart Wallace, Sindre Sorhus\n\n### Accounts\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-65404: Arni Hardarson (Neonix Security), Vinay Kumar Rasala (Xplo8E) from Appknox, Stuart Wallace, 이재영\n\n### APFS\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\n### App Intents\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A privacy issue was addressed with improved access restrictions.\n\nCVE-2026-84582: Zhongcheng Li (CK01)\n\nEntry added October 19, 2026\n\n### App Store\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A local app may be able to read a persistent account identifier\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86888: Zhongcheng Li (CK01)\n\n### Apple Account\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2026-20683: Dem0ns (@天府简易信工作室), Abdelhak Kherroubi, Jasminder Pal Singh, Lehan Dilusha Jayasingha (Sri Lanka)\n\n### Apple Intelligence\n\nAvailable for: iPhone 15 Pro and later, iPad Pro 12.9-inch 5th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 5th generation and later, and iPad mini 7th generation\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-86920: Johan Wahyudi\n\nCVE-2026-86955: Abodi Dawoud\n\nEntry added October 19, 2026, updated October 26, 2026\n\n### Apple Neural Engine\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65408: tamdao\n\n### Apple Neural Engine\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-84634: S. Rosario\n\nEntry added October 26, 2026\n\n### Apple Neural Engine\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84595: tamdao\n\nEntry added October 26, 2026\n\n### AppleAVD\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\n### AppleDouble\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84519: Richard Zana\n\n### AppleKeyStore\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-84593: Meta Red Team X - Nik Tsytsarkin, Alexandre Borges\n\n### Authentication Services\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to delete credentials stored in Keychain\n\nCVE-2026-86905: Ilya Andr (andrd3v)\n\n### AuthKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A local app may be able to read a persistent account identifier\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\n### AVEVideoEncoder\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-65410: Calif.io in collaboration with Claude and Anthropic Research\n\n### AVEVideoEncoder\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-84616: Peter Malone\n\n### AVEVideoEncoder\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A sandboxed app may be able to execute arbitrary code with kernel privileges\n\nDescription: A race condition was addressed with improved state management.\n\nCVE-2026-84607: Ruslan Dautov\n\n### BackgroundAssets\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\n### Baseband\n\nAvailable for: iPhone 11 and later\n\nImpact: An attacker in radio range may be able to cause unexpected system termination\n\nDescription: An input validation issue was addressed with improved input validation.\n\nCVE-2026-86885: Tuan D. Hoang, Hazem Issa, and Yongdae Kim @ KAIST SysSec Lab\n\n### Baseband\n\nAvailable for: iPhone 11 and later\n\nImpact: A remote attacker may be able to cause a denial-of-service\n\nDescription: A denial-of-service issue was addressed with improved input validation.\n\nCVE-2026-86879: Hazem Issa and Yongdae Kim @ SysSec, KAIST\n\n### Baseband\n\nAvailable for: iPhone 11 and later\n\nImpact: An attacker in a privileged network position may be able to cause a denial-of-service\n\nDescription: A denial-of-service issue was addressed with improved input validation.\n\nCVE-2026-86963: Beomseok Oh (@KAIST), Yongdae Kim (@KAIST)\n\nEntry added October 19, 2026\n\n### Bluetooth\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### Bluetooth\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may gain unauthorized access to Bluetooth\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-84560: an anonymous researcher\n\n### Bluetooth\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An attacker in radio range may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nEntry added October 19, 2026\n\n### Camera\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86878: Sindre Sorhus, Ilya Andr (andrd3v) of Positive Technologies, Asaf Cohen\n\n### CloudKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A local app may be able to read a persistent account identifier\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nCVE-2026-86895: Stanislav Jelezoglo\n\n### CloudKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to read device name\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86893: Heiner Gerdes\n\n### copyfile\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An archive may be able to bypass Gatekeeper\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola, an anonymous researcher\n\n### copyfile\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to modify protected parts of the file system\n\nCVE-2026-86966: Jihwan Yoon\n\nEntry added October 26, 2026\n\n### Core Bluetooth\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An attacker with a paired Bluetooth device may be able to execute arbitrary code\n\nDescription: A stack overflow was addressed with improved input validation.\n\nCVE-2026-86919: Mathis Mansière\n\nEntry added October 19, 2026\n\n### Core Bluetooth\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted Bluetooth packet may result in disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112608: Duc Anh Nguyen & Ta Duc Thien\n\nEntry added October 26, 2026\n\n### CoreMedia\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed by removing the vulnerable code.\n\n### CoreMedia\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A sandboxed process may be able to circumvent sandbox restrictions\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86876: Chris Bailey - Short Circuit\n\n### CoreMedia\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### CoreMedia\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nEntry added October 19, 2026\n\n### CoreML\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A sandboxed app may be able to access restricted files\n\nDescription: A permissions issue was addressed with improved path validation.\n\nCVE-2026-84624: AL Najafi, tamdao\n\n### CoreMotion\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to access motion data from headphones without user consent\n\nCVE-2026-43737: Stuart Wallace\n\n### CoreText\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing web content may lead to a denial-of-service\n\nDescription: A null pointer dereference was addressed with improved input validation.\n\n### CoreText\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-84596: ret2happy, Meta Product Security\n\n### CoreUI\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\n### CoreUI\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause a denial of service\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-84489: stratan (@5tratan), Peter Malone\n\n### CoreUI\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-84571: stratan (@5tratan), Peter Malone\n\n### CoreUI\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted asset catalog may result in disclosure of process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43738: Peter Malone\n\n### CoreUI\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted asset catalog may lead to unexpected process termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84511: Rahul Raj, stratan (@5tratan)\n\n### DeviceCheck\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to read persistent device identifiers\n\nDescription: An authorization issue was addressed with improved access control.\n\nCVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill (@jjtech@infosec.exchange)\n\n### Disk Images\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-84552: Tommy DeVoss from Braze Security Team (@thedawgyg), flower xu, Adriatik Raci, PETOWORKS의 Bugeun Choi (@Bugeun), Peter Malone, Daisuke Hatakeyama and Ryohei Ueki (@SYZD Research), Hyunwoo Kim (@v4bel)\n\n### exFAT\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Mounting a maliciously crafted volume may lead to unexpected system termination\n\nDescription: A heap buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-84510: Meta Red Team X - Nik Tsytsarkin, Richard Zana\n\n### File Bookmark\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to modify a file it only had permission to read\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya Kumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)\n\n### file_cmds\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n\nDescription: A path handling issue was addressed with improved validation.\n\nCVE-2026-84534: Geoffrey Lovelace\n\n### Filters\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: A memory corruption issue was addressed with improved input validation.\n\nCVE-2026-43688: Peter Malone\n\n### FontParser\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted font file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-84524: an anonymous researcher\n\n### FontParser\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read issue was addressed with improved input validation.\n\n### Foundation\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause a denial of service\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research\n\n### Foundation\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-86961: an anonymous researcher\n\nEntry added October 19, 2026\n\n### Graphics\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg), Jiyong Yang\n\n### Heimdal\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An attacker in a privileged network position may be able to modify network traffic\n\nDescription: A cryptographic issue was addressed with improved integrity checks.\n\nCVE-2026-84533: Vishal Patidar, Roman Zabicki\n\n### Heimdal\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause a denial-of-service\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-86942: He Wei (ギカク)\n\nEntry added October 26, 2026\n\n### iCloud\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to identify a user across reinstalls\n\nCVE-2026-84606: Ilya Andr (andrd3v)\n\n### Image Capture\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to access user-sensitive data\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted image may result in disclosure of process memory\n\nDescription: An uninitialized memory issue was addressed with improved memory initialization.\n\nCVE-2026-84564: Justin O'Leary (@olearysec) of olearysec.com\n\nEntry updated October 19, 2026\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted image may result in memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-64750: Mateusz Jurczyk of Google Project Zero, Eddy Tsalolikhin, Johann Rehberger\n\nCVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan\n\nEntry updated October 26, 2026\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted image may lead to unexpected process termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-86975: Tommy DeVoss from Braze Security Team (@thedawgyg), an anonymous researcher\n\nEntry added October 19, 2026\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-64759: Musaab Khan (@bxff), XlabAI Team of Tencent Xuanwu Lab, Atuin Automated Vulnerability Discovery Engine, Guannan Wang, Zhanpeng Liu, Jiashuo Liang, Guancheng Li, Iain Harkiss, Daniel Febrero\n\nEntry added October 26, 2026\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-86954: Mateusz Jurczyk of Google Project Zero\n\nEntry added October 26, 2026\n\n### IOKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, 이재영\n\n### IOMobileFrameBuffer\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nCVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0, dbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin\n\n### IOSurfaceAccelerator\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to leak sensitive kernel state\n\nDescription: An information leakage was addressed with additional validation.\n\nCVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing Intelligence\n\n### iWork\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A malicious app may be able to break out of its sandbox\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-65354: Csaba Fitzl (@theevilbit) of Iru\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-28968: genter0, Svetoslav Stolarov, Josh Maine of Calif.io, Dun\n\nEntry updated October 19, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-84566: Bernhard Jackiewicz\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A local user may be able to cause unexpected system termination or read kernel memory\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-65415: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-84561: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Bhaswanth Chigurupati\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-84630: Tristan Madani (@TristanInSec) from Talence Security\n\nCVE-2026-65360: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-65358: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-65377: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ye Zhang (@VAR10CK) of Baidu Security\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app with root privileges may be able to read uninitialized kernel memory\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-84622: Hiroki Imai (LAC Co., Ltd.)\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-43689: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Connecting to a malicious NFS server may disclose kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43687: R4mbb of KRsecurity, Peter Malone\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Connecting to a malicious NFS server may lead to kernel memory corruption\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-43686: Peter Malone\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to determine kernel memory layout\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-65405: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to disclose kernel memory\n\nCVE-2026-84530: Vladislav Shevchenko (Positive Technologies)\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-84521: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-65402: Fábio Luís @scanpt, Richard Zana, Billy J","published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":27527,"url":"https://support.apple.com/en-us/149038","title":"Apple: About the security content of visionOS 27 - Apple Support","kind":"vendor","source":"nvd","publisher":"vendor","text":"About the security content of visionOS 27 - Apple Support\n\n# About the security content of visionOS 27\n\nThis document describes the security content of visionOS 27.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## visionOS 27\n\nReleased September 14, 2026\n\n### Accelerate Framework\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted image may lead to unexpected process termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86882: Peter Malone\n\n### Accelerate Framework\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86918: Arni Hardarson (Neonix Security)\n\nEntry added October 19, 2026\n\n### APFS\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\n### App Intents\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A privacy issue was addressed with improved access restrictions.\n\nCVE-2026-84582: Zhongcheng Li (CK01)\n\nEntry added October 19, 2026\n\n### App Store\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A local app may be able to read a persistent account identifier\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86888: Zhongcheng Li (CK01)\n\n### Apple Account\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2026-20683: Dem0ns (@天府简易信工作室), Abdelhak Kherroubi, Jasminder Pal Singh, Lehan Dilusha Jayasingha (Sri Lanka)\n\n### Apple Intelligence\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-86920: Johan Wahyudi\n\nEntry added October 26, 2026\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-84634: S. Rosario\n\nEntry added October 26, 2026\n\n### Apple Neural Engine\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84595: tamdao\n\nEntry added October 26, 2026\n\n### AppleAVD\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\n### Audio\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to leak sensitive user information\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin\n\n### Authentication Services\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to delete credentials stored in Keychain\n\nDescription: This issue was addressed by removing the vulnerable code.\n\nCVE-2026-86905: Ilya Andr (andrd3v)\n\n### AuthKit\n\nImpact: A local app may be able to read a persistent account identifier\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\n### AVEVideoEncoder\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-65410: Calif.io in collaboration with Claude and Anthropic Research\n\n### AVEVideoEncoder\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-84616: Peter Malone\n\n### AVEVideoEncoder\n\nImpact: A sandboxed app may be able to execute arbitrary code with kernel privileges\n\nDescription: A race condition was addressed with improved state management.\n\nCVE-2026-84607: Ruslan Dautov\n\n### BackgroundAssets\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\n### Bluetooth\n\nImpact: A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### Bluetooth\n\nImpact: An app may gain unauthorized access to Bluetooth\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-84560: an anonymous researcher\n\n### Bluetooth\n\nImpact: An attacker in radio range may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84613: jioundai\n\nEntry added October 19, 2026\n\n### CloudKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A local app may be able to read a persistent account identifier\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nCVE-2026-86895: Stanislav Jelezoglo\n\n### CloudKit\n\nImpact: An app may be able to read device name\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-86893: Heiner Gerdes\n\n### copyfile\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An archive may be able to bypass Gatekeeper\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola, an anonymous researcher\n\n### copyfile\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to modify protected parts of the file system\n\nCVE-2026-86966: Jihwan Yoon\n\nEntry added October 26, 2026\n\n### Core Bluetooth\n\nImpact: An attacker with a paired Bluetooth device may be able to execute arbitrary code\n\nDescription: A stack overflow was addressed with improved input validation.\n\nCVE-2026-86919: Mathis Mansière\n\nEntry added October 19, 2026\n\n### Core Bluetooth\n\nImpact: Processing a maliciously crafted Bluetooth packet may result in disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112608: Duc Anh Nguyen & Ta Duc Thien\n\nEntry added October 26, 2026\n\n### CoreMedia\n\nImpact: Processing a maliciously crafted image may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed by removing the vulnerable code.\n\nCVE-2026-64752: Nik Tsytsarkin\n\n### CoreMedia\n\nImpact: A sandboxed process may be able to circumvent sandbox restrictions\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86876: Chris Bailey - Short Circuit\n\n### CoreMedia\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-65344: Siyeong kim\n\n### CoreMedia\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-86913: Meta Product Security\n\nEntry added October 19, 2026\n\n### CoreML\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A sandboxed app may be able to access restricted files\n\nDescription: A permissions issue was addressed with improved path validation.\n\nCVE-2026-84624: AL Najafi, tamdao\n\n### CoreText\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing web content may lead to a denial-of-service\n\nDescription: A null pointer dereference was addressed with improved input validation.\n\nCVE-2026-65412: Pavan Nallamothu\n\n### CoreText\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-84596: ret2happy, Meta Product Security\n\n### CoreUI\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\n### CoreUI\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-84571: stratan (@5tratan), Peter Malone\n\n### CoreUI\n\nImpact: Processing a maliciously crafted asset catalog may lead to unexpected process termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84511: Rahul Raj, stratan (@5tratan)\n\n### DeviceCheck\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to read persistent device identifiers\n\nDescription: An authorization issue was addressed with improved access control.\n\nCVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill (@jjtech@infosec.exchange)\n\n### File Bookmark\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to modify a file it only had permission to read\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya Kumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)\n\n### file_cmds\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n\nDescription: A path handling issue was addressed with improved validation.\n\nCVE-2026-84534: Geoffrey Lovelace\n\n### FontParser\n\nImpact: Processing a maliciously crafted font file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-84524: an anonymous researcher\n\n### FontParser\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read issue was addressed with improved input validation.\n\nCVE-2026-84597: Nik Tsytsarkin\n\n### Foundation\n\nImpact: An app may be able to cause a denial of service\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research\n\n### Graphics\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg), Jiyong Yang\n\n### Heimdal\n\nCVE-2026-86942: He Wei (ギカク)\n\nEntry added October 26, 2026\n\n### iCloud\n\nImpact: An app may be able to identify a user across reinstalls\n\nCVE-2026-84606: Ilya Andr (andrd3v)\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may result in disclosure of process memory\n\nDescription: An uninitialized memory issue was addressed with improved memory initialization.\n\nCVE-2026-84564: Justin O'Leary (@olearysec) of olearysec.com\n\nEntry updated October 19, 2026\n\n### ImageIO\n\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\n### ImageIO\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\n### ImageIO\n\nCVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to unexpected process termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-86975: Tommy DeVoss from Braze Security Team (@thedawgyg), an anonymous researcher\n\nEntry added October 19, 2026\n\n### ImageIO\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-86954: Mateusz Jurczyk of Google Project Zero\n\nEntry added October 26, 2026\n\n### IOGPUFamily\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-64788: Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi\n\nEntry updated October 19, 2026\n\n### IOKit\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, 이재영\n\n### IOMobileFrameBuffer\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nCVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0, dbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin\n\nCVE-2026-64736: Ruslan Dautov, hxr1\n\n### IOSurfaceAccelerator\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to leak sensitive kernel state\n\nDescription: An information leakage was addressed with additional validation.\n\nCVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing Intelligence\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-28968: genter0, Svetoslav Stolarov, Josh Maine of Calif.io, Dun\n\nEntry updated October 19, 2026\n\n### Kernel\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A local user may be able to cause unexpected system termination or read kernel memory\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-65415: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\n### Kernel\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A remote attacker may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\n### Kernel\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-65349: an anonymous researcher\n\n### Kernel\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-84561: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Bhaswanth Chigurupati\n\n### Kernel\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-84630: Tristan Madani (@TristanInSec) from Talence Security\n\nCVE-2026-65360: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-65358: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-65377: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ye Zhang (@VAR10CK) of Baidu Security\n\n### Kernel\n\nImpact: An app with root privileges may be able to read uninitialized kernel memory\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-84622: Hiroki Imai (LAC Co., Ltd.)\n\n### Kernel\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-43689: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Kernel\n\nImpact: Connecting to a malicious NFS server may disclose kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43687: R4mbb of KRsecurity, Peter Malone\n\n### Kernel\n\nImpact: Connecting to a malicious NFS server may lead to kernel memory corruption\n\nCVE-2026-43686: Peter Malone\n\n### Kernel\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-65405: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nCVE-2026-84530: Vladislav Shevchenko (Positive Technologies)\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-84521: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-65402: Fábio Luís @scanpt, Richard Zana, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: A local user may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-65359: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-84507: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2026-86903: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-65330: Ashish Kunwar, Mikhail Lozhnikov of Positive Technologies, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Bhaswanth Chigurupati\n\nCVE-2026-28935: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-84599: an anonymous researcher\n\nEntry updated October 26, 2026\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved checks.\n\nCVE-2026-84602: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-86962: OpenAI, Hüseyin Kabasakal @HuseyinK01\n\nEntry added October 19, 2026\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nCVE-2026-86964: Ryan Hileman via Xint Code (xint.io)\n\nEntry added October 26, 2026\n\n### libarchive\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: A heap buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-86870: Kitten Food\n\n### Managed Configuration\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A privacy issue was addressed with improved handling of files.\n\nCVE-2026-86883: Sindre Sorhus, Morris Richman (@morrisinlife), Stuart Wallace, Tristan Brennan\n\n### MediaRemote\n\nImpact: A sandboxed app may be able to access the System Keychain\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-84628: Myeonghun Pak, Nathaniel Oh (@calysteon), Alan Banderas (@creeper4004)\n\n### MobileBackup\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: A path handling issue was addressed with improved validation.\n\nCVE-2026-65411: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\n### Model I/O\n\nImpact: Opening a maliciously crafted file may lead to unexpected process termination\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-84497: Yiğit Can YILMAZ (@yilmazcanyigit)\n\n### Music\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-84615: Stanislav Jelezoglo\n\n### NetworkExtension\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-43695: Claudio Bozzato and Francesco Benvenuto of Cisco Talos\n\n### NetworkExtension\n\nImpact: An app may be able to identify what other apps a user has installed\n\nDescription: An information disclosure issue was addressed with improved state management.\n\nCVE-2026-84626: Hoffcona of IES Red Team\n\nEntry updated October 19, 2026\n\n### Photos Storage\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-84491: an anonymous researcher\n\n### Photos Storage\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to fingerprint the user\n\nDescription: This issue was addressed with additional entitlement checks.\n\nCVE-2026-84629: Stanislav Jelezoglo\n\n### RawCamera\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted image may lead to heap corruption\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-84627: Mateusz Jurczyk of Google Project Zero, Piotr Jerzy Duszynski, f0r of MurphySec, PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj, ธนกฤต ทัฬหะ\n\nEntry added October 26, 2026\n\n### RealityKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-28966: stratan (@5tratan)\n\n### RealityKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n\nDescription: An out-of-bounds read issue was addressed with improved input validation.\n\nCVE-2026-84532: Franco Belman at Blackwing Intelligence, Hongsik Kim (mnur), stratan (@5tratan)\n\nEntry updated October 26, 2026\n\n### Reminders\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-65403: Rahul Raj\n\n### Safe Browsing\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with additional entitlement checks.\n\nCVE-2026-86897: Stuart Wallace\n\n### Sandbox\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to bypass network restrictions\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2026-84551: Issa Sancho\n\n### Sandbox Profiles\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to fingerprint the user\n\nDescription: A permissions issue was addressed with additional sandbox restrictions.\n\nCVE-2026-84625: Ilya Andr (andrd3v) of Positive Technologies, CJ Vana\n\n### Sandbox Profiles\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-84603: Gongyu Ma (@Mezone0), CJ Vana, Stanislav Jelezoglo\n\n### SceneKit\n\nImpact: Processing a maliciously crafted file may result in disclosure of process memory\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-84487: stratan (@5tratan), Dhiyanesh Selvaraj (@redroot97), Peter Malone\n\n### SceneKit\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-84632: Peter Malone\n\n### SceneKit\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-84620: Peter Malone\n\n### SceneKit\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nCVE-2026-84546: Narendra Singh (@_3P1C), stratan (@5tratan), Peter Malone\n\nCVE-2026-84611: Nathaniel Oh (@calysteon)\n\n### SceneKit\n\nImpact: Processing a maliciously crafted 3D scene may lead to unexpected process termination\n\nCVE-2026-84526: stratan (@5tratan)\n\n### Security\n\nImpact: An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n\nCVE-2026-86881: Surya Narayan Kushwaha, Roman Zabicki, John Lussier, Filip Olszak\n\n### Security\n\nCVE-2026-84508: Abodi Dawoud, Merrick Hare, Roelof van Dijk\n\nEntry added October 19, 2026\n\n### Shortcuts\n\nImpact: A malicious shortcut may be able to send messages without user confirmation\n\nCVE-2026-84600: Owen Pawling (@owenpawling)\n\n### Shortcuts\n\nCVE-2026-28850: OSORI\n\nEntry added October 19, 2026\n\n### Siri\n\nImpact: A local attacker may be able to overwrite restricted files\n\nCVE-2026-86921: Jonghoon Han (Aegis), bubu, 이재영, Tae Woo Kim, Dawuge of Shuffle Team\n\nEntry added October 19, 2026\n\n### Software Update\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to modify protected system files\n\nDescription: A permissions issue was addressed with improved path validation.\n\nCVE-2026-84609: YingMuo (@YingMuo) of DEVCORE Research Team\n\n### SpringBoard\n\nImpact: An app may be able to cause a denial-of-service\n\nCVE-2026-86892: Lehan Dilusha Jayasingha\n\n### Symptom Framework\n\nImpact: A malicious application may be able to determine a user's current location\n\nCVE-2026-84513: Sindre Sorhus\n\n### TCC\n\nCVE-2026-84527: Zeyang Li&Yuxiang Wang of Chongqing Telecom\n\n### Time Zone\n\nImpact: An app may be able to bypass certain Privacy preferences\n\nCVE-2026-86887: an anonymous researcher\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process termination\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-84635: Souta Sugiyama\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43795: wwwlk\n\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 318405\n\nCVE-2026-65341: Henock Habte\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nWebKit Bugzilla: 321480\n\nCVE-2026-64782: Charles Kern, Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may disclose sensitive user information\n\nDescription: A permissions issue was addressed by removing the vulnerable code.\n\nWebKit Bugzilla: 315121\n\nCVE-2026-64753: Viggo Lekdorf\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved input validation.\n\nWebKit Bugzilla: 321484\n\nCVE-2026-64781: Thomas Guillem\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: This issue was addressed through improved state management.\n\nWebKit Bugzilla: 321517\n\nCVE-2026-65351: Niels Hofmans\n\nWebKit Bugzilla: 316996\n\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo)\n\nWebKit Bugzilla: 317142\n\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317349\n\nCVE-2026-65336: Josef Korbel\n\nWebKit Bugzilla: 316723\n\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317603\n\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317450\n\nCVE-2026-65332: Kun Peeks (@SwayZGl1tZyyy), OpenAI Codex Security - Amy Burnett\n\nWebKit Bugzilla: 317611\n\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 316347\n\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\n### WebKit\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313703\n\nCVE-2026-64787: 杉山 壮太, Shubham Chaskar\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: The issue was addressed with improved checks.\n\nWebKit Bugzilla: 316918\n\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nWebKit Bugzilla: 316791\n\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nWebKit Bugzilla: 317317\n\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\n### WebKit\n\nImpact: Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n\nDescription: A logic issue was addressed with improved state management.\n\nWebKit Bugzilla: 318271\n\nCVE-2026-86898: Tomi Garcia (archyxsec)\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: A type confusion issue was addressed with improved state management.\n\nWebKit Bugzilla: 308231\n\nCVE-2026-86922: Nathaniel Oh (@calysteon), Kwak Kiyong / kakaogames\n\nEntry added October 19, 2026\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to unexpected behavior\n\nDescription: A logic issue was addressed with improved state management.\n\nWebKit Bugzilla: 318807\n\nCVE-2026-86872: Junhyuk Im of S2W Inc, Seungyun Lee of S2W Inc\n\nEntry added October 19, 2026\n\n### WebKit Canvas\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 313935\n\nCVE-2026-64718: Niels Hofmans, OGINOME Tomohito, an anonymous researcher\n\n### WebKit History\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Visiting a maliciously crafted website may leak sensitive data\n\nDescription: The issue was addressed with improved checks.\n\nWebKit Bugzilla: 322124\n\nCVE-2026-64778: Mohit Negi\n\n### WebKit Storage\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nCVE-2026-64779: Tommy DeVoss from Braze Security Team (@thedawgyg), Shubham Chaskar\n\n### WebRTC\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-65391: Myungyong Lee\n\n### WebRTC\n\nImpact: Processing maliciously crafted web content may lead to memory corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65390: Kwak Kiyong (@Pwnkai23), Song Nuri\n\n### Wi-Fi\n\nImpact: An attacker in physical proximity may be able to cause a denial-of-service\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86953: Efstratios Kaplanellis (@5tratan) of Almamater Technologies, Jakob Pammer\n\nEntry added October 19, 2026, updated October 26, 2026\n\n### Wi-Fi\n\nImpact: An attacker in wireless proximity may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-86957: Drin Raci of sentry.security, Niels Hofmans\n\nEntry added October 19, 2026\n\n### Wi-Fi Connectivity\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-84636: Sindre Sorhus, Jian Lee (@speedyfriend433)\n\nEntry updated October 19, 2026\n\n## Additional recognition\n\n### Accounts\n\nWe would like to acknowledge Wojciech Regula of SecuRing (wojciechregula.blog) for their assistance.\n\n### Apple Intelligence\n\nWe would like to acknowledge an anonymous researcher for their assistance.\n\n### AppleKeyStore\n\nWe would like to acknowledge Abdurrahman Nafi, Francisco Knabe, Karol Mazurek (@Karmaz95) of AFINE, Somair Ansar, YOKI, an anonymous researcher, 晓娟 谢 for their assistance.\n\n### AVEVideoEncoder\n\nWe would like to acknowledge tamdao for their assistance.\n\n### Bluetooth\n\nWe would like to acknowledge Suresh Sundaram, Youssef Ahmed Saad for their assistance.\n\n### Calendar\n\nWe would like to acknowledge Dany Assuid, Jacob Hazak from Zero-Defense Labs, Varik Matevosyan, stratan (@5tratan) for their assistance.\n\n### CipherML\n\nWe would like to acknowledge Nils Hanff (@nils1729@chaos.social) of Hasso Plattner Institute for their assistance.\n\n### CloudKit\n\nWe would like to acknowledge Hikerell (Loadshine Lab) for their assistance.\n\n### Compression\n\nWe would like to acknowledge Tommy DeVoss from Braze Security Team (@thedawgyg) for their assistance.\n\n### copyfile\n\nWe would like to acknowledge Morris Richman (@morrisinlife) and Jian Lee (@speedyfriend433) for their assistance.\n\n### CoreAnimation\n\nWe would like to acknowledge Duy Trần (@khanhduytran0) for their assistance.\n\n### CoreAudio\n\nWe would like to acknowledge Patrick Saif / x.com/weezerOSINT / github.com/sai2fast for their assistance.\n\n### CoreBluetooth - LE\n\nWe would like to acknowledge Ashmit Sharma & Atul RV, Dun, Maliq Barnard, Nicholas C. of Onymos Inc. (onymos.com), Peter Malone, Robert M for their assistance.\n\n### CoreGraphics\n\nWe would like to acknowledge Gandalf4a of PKU-Changsha Institute for Computing and Digital Economy for their assistance.\n\n### CoreMedia\n\nWe would like to acknowledge Chris Bailey - Short Circuit for their assistance.\n\n### CoreText\n\nWe would like to acknowledge Jian Lee (@speedyfriend433) for their assistance.\n\n### CoreUI\n\nWe would like to acknowledge Peter Malone for their assistance.\n\n### DataAccess\n\nWe would like to acknowledge Adetayo Adebimpe (Cyboghostginx) for their assistance.\n\n### FaceTime\n\nWe would like to acknowledge Souhaib Naceri for their assistance.\n\n### Files\n\nWe would like to acknowledge an anonymous researcher for their assistance.\n\n### iCloud\n\nWe would like to acknowledge 3ndy1(@_3ndy1) and moyu for their assistance.\n\n### ImageIO\n\nWe would like to acknowledge Kun Peeks (@SwayZGl1tZyyy), Muhamad Syaiful, Ronen Seleri & Shahaf Pruss, an anonymous researcher, songbird for their assistance.\n\nEntry updated October 19, 2026\n\n### IOSurfaceAccelerator\n\nWe would like to acknowledge Chanwit Muenprakoddee (ChemIndy), Franco Belman at Blackwing Intelligence, Iain Harkiss, an anonymous researcher, beist, hxr1 for their assistance.\n\n### Kernel\n\nWe would like to acknowledge Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Cem Onat Karagun, James Duffy (@0x4A616D657344), Lyutoon, Nebula Security (@nebusecurity), Nicolas Seriot, Peter Malone, Redon Gashi of Sentry, Robert Tran, Xiang Li from AOSP Lab @Nankai University, Yongsong Yu, an anonymous researcher for their assistance.\n\nEntry updated October 26, 2026\n\n### LaunchServices\n\nWe would like to acknowledge Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) for their assistance.\n\n### mDNSResponder\n\nWe would like to acknowledge Anton Pakhunov, Franciszek Kalinowski (striga.ai / isec.pl), Hannes Weissteiner, Roland Czerny, Simone Franza, Stefan Gast and Daniel Gruss of Graz University of Technology, and Johanna Ullrich of the Interdisciplinary Transformation University (IT:U), Issa Sancho, Jian Zhou, 章鱼哥@aipy (aipyaipy.com), and Sindre Sorhusfor their assistance.\n\nEntry updated October 19, 2026\n\n### Notifications\n\nWe would like to acknowledge Abhay Kailasia (@abhay_kailasia) from Safran Mumbai India, Himanshu Bharti @Xpl0itme From Khatima, Jan Rokita (rokita.me) for their assistance.\n\n### Passwords\n\nWe would like to acknowledge Catalin Lita of Moralis, Christian Kohlschütter, David Coomber of Info-Sec.CA, Lukasz Tulikowski at Software Cloud, Sujay Amin, an anonymous researcher for their assistance.\n\n### Printing\n\nWe would like to acknowledge Stuart Wallace for their assistance.\n\n### Pro Res\n\nWe would like to acknowledge Meta Red Team X - Nik Tsytsarkin for their assistance.\n\n### RemoteServiceDiscovery\n\nWe would like to acknowledge Tristan Madani (@TristanInSec) from Talence Security, an anonymous researcher for their assistance.\n\n### Safari\n\nWe would like to acknowledge Dem0ns @天府简易信工作室 for their assistance.\n\n### Sandbox Profiles\n\nWe would like to acknowledge Lachlan Bauerochse for their assistance.\n\n### Security\n\nWe would like to acknowledge John Lussier, Roman Zabicki for their assistance.\n\nWe would like to acknowledge Atul Kishor Jaiswal, Benjamin Hornbeck for their assistance.\n\n### Shortcuts\n\nWe would like to acknowledge Csaba Fitzl (@theevilbit) of Iru, Owen Pawling (@owenpawling) for their assistance.\n\n### VoiceOver\n\nWe would like to acknowledge Hariji Vivek Pandey for their assistance.\n\n### WebKit\n\nWe would like to acknowledge @TristanInSec, Behzad Najjarpour Jabbari (@_G4ru_), Big Bear, Eddy Tsalolikhin, Henock Habte, Henock Habte, Kenneth Hsu, Maher Azzouzi, Meridian Miftari, OpenAI Codex Security - Amy Burnett, Souta Sugiyama, Vitaly Simonovich, an anonymous researcher, hamayanhamayan, lattice, lebr0nli of National Yang Ming Chiao Tung University, Security and Systems Lab, ret2happy, wwwlk, and Qadhafy Muhammad Tera for their assistance.\n\nEntry updated October 19, 2026\n\n### WebKit Canvas\n\nWe would like to acknowledge Utkarsh Pal for their assistance.\n\n### WebKit JavaScript Bindings\n\nWe would like to a","published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":27323,"url":"https://support.apple.com/en-us/149041","title":"Apple: About the security content of iOS 26.7 and iPadOS 26.7 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of iOS 26.7 and iPadOS 26.7 - Apple Support\n\n# About the security content of iOS 26.7 and iPadOS 26.7\n\nThis document describes the security content of iOS 26.7 and iPadOS 26.7.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 26.7 and iPadOS 26.7\n\nReleased September 14, 2026\n\n### Accelerate Framework\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted image may lead to unexpected process termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86882: Peter Malone\n\n### Accessibility\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with improved data protection.\n\nCVE-2026-43664: Stuart Wallace, Rosyna Keller of Totally Not Malicious Software, Jian Lee (@speedyfriend433), Ilya Andr (andrd3v), Gongyu Ma (@Mezone0), David Strnadel, Daniel Febrero, CJ Vana, Asaf Cohen\n\n### APFS\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\n### Apple Neural Engine\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-65408: tamdao\n\n### AppleAVD\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\n### AppleDouble\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84519: Richard Zana\n\n### AuthKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A local app may be able to read a persistent account identifier\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\n### AVEVideoEncoder\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-65410: Calif.io in collaboration with Claude and Anthropic Research\n\n### AVEVideoEncoder\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-84616: Peter Malone\n\n### AVEVideoEncoder\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A sandboxed app may be able to execute arbitrary code with kernel privileges\n\nDescription: A race condition was addressed with improved state management.\n\nCVE-2026-84607: Ruslan Dautov\n\n### BackgroundAssets\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\n### Baseband\n\nAvailable for: iPhone 11 and later\n\nImpact: An attacker in a privileged network position may be able to cause a denial-of-service\n\nDescription: A denial-of-service issue was addressed with improved input validation.\n\nCVE-2026-86963: Beomseok Oh (@KAIST), Yongdae Kim (@KAIST)\n\nEntry added October 19, 2026\n\n### Bluetooth\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### Bluetooth\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker in radio range may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84613: jioundai\n\nEntry added October 19, 2026\n\n### copyfile\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An archive may be able to bypass Gatekeeper\n\nDescription: A file quarantine bypass was addressed with additional checks.\n\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola, an anonymous researcher\n\n### Core Bluetooth\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker with a paired Bluetooth device may be able to execute arbitrary code\n\nDescription: A stack overflow was addressed with improved input validation.\n\nCVE-2026-86919: Mathis Mansière\n\nEntry added October 19, 2026\n\n### CoreAudio\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n\nDescription: An out-of-bounds access issue was addressed with improved bounds checking.\n\nCVE-2026-113912: an anonymous researcher, 章鱼哥@aipy (aipyaipy.com), Roman Zabicki, Anna Groza (@pwnlambda) of Calif.io\n\nEntry added October 26, 2026\n\n### CoreMedia\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### CoreMedia\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A sandboxed process may be able to circumvent sandbox restrictions\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86876: Chris Bailey - Short Circuit\n\n### CoreMedia\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-86913: Meta Product Security\n\nEntry added October 19, 2026\n\n### CoreMedia\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Parsing a file may lead to an unexpected app termination or arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-112688: 정우 하 (@0xfa11babe), Chris Bailey - Short Circuit\n\nEntry added October 26, 2026\n\n### CoreMedia Video Toolbox\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43702: Nathaniel Oh (@calysteon)\n\n### CoreML\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A sandboxed app may be able to access restricted files\n\nDescription: A permissions issue was addressed with improved path validation.\n\nCVE-2026-84624: AL Najafi, tamdao\n\n### CoreMotion\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access motion data from headphones without user consent\n\nDescription: An authorization issue was addressed with improved validation.\n\nCVE-2026-43737: Stuart Wallace\n\n### CoreText\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing web content may lead to a denial-of-service\n\nDescription: A null pointer dereference was addressed with improved input validation.\n\nCVE-2026-65412: Pavan Nallamothu\n\n### DeviceCheck\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to read persistent device identifiers\n\nDescription: An authorization issue was addressed with improved access control.\n\nCVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill (@jjtech@infosec.exchange)\n\n### Disk Images\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-84552: Tommy DeVoss from Braze Security Team (@thedawgyg), flower xu, Adriatik Raci, PETOWORKS의 Bugeun Choi (@Bugeun), Peter Malone, Hyunwoo Kim (@v4bel), Daisuke Hatakeyama and Ryohei Ueki (@SYZD Research)\n\n### exFAT\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Mounting a maliciously crafted volume may lead to unexpected system termination\n\nDescription: A heap buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-84510: Richard Zana, Meta Red Team X - Nik Tsytsarkin\n\n### file_cmds\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n\nDescription: A path handling issue was addressed with improved validation.\n\nCVE-2026-84534: Geoffrey Lovelace\n\n### FontParser\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted font file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-84524: an anonymous researcher\n\n### Foundation\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause a denial of service\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research\n\n### Graphics\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg), Jiyong Yang\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted image may result in disclosure of process memory\n\nDescription: An uninitialized memory issue was addressed with improved memory initialization.\n\nCVE-2026-84564: Justin O'Leary (@olearysec) of olearysec.com\n\nEntry updated October 19, 2026\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: The issue was addressed with improved bounds checks.\n\nCVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh)\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted image may corrupt process memory\n\nDescription: A buffer overflow issue was addressed with improved memory handling.\n\nCVE-2026-43661: Gandalf4a of PKU-ICODE, Anton Pakhunov, an anonymous researcher\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted image may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86869: Niels Hofmans, Meta Red Team X, Geonha Lee (@leegn4a), Chris Bailey - Short Circuit\n\n### ImageIO\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted image may result in memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan\n\n### IOAcceleratorFamily\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-86944: f00l (@PPPF00L) and 3ndy1(@_3ndy1)\n\nEntry added October 19, 2026\n\n### IOGPUFamily\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-43743: Lyutoon, Dun\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-84566: Bernhard Jackiewicz\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-28968: Svetoslav Stolarov, Josh Maine of Calif.io, genter0, Dun\n\nEntry updated October 19, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A malicious app may be able to gain root privileges\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-43689: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2026-65377: Ye Zhang (@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Connecting to a malicious NFS server may disclose kernel memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-43687: R4mbb of KRsecurity, Peter Malone\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-43684: Peter Malone\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Connecting to a malicious NFS server may lead to kernel memory corruption\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-43686: Peter Malone\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to determine kernel memory layout\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-65405: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-84630: Tristan Madani (@TristanInSec) from Talence Security\n\nCVE-2026-65360: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: An information disclosure issue was addressed with improved memory management.\n\nCVE-2026-84530: Vladislav Shevchenko (Positive Technologies)\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app with root privileges may be able to read uninitialized kernel memory\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-84622: Hiroki Imai (LAC Co., Ltd.)\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved checks.\n\nCVE-2026-84602: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-65402: Fábio Luís @scanpt, Richard Zana, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nCVE-2026-84521: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-84507: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-84561: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Bhaswanth Chigurupati\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A local user may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-65359: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A double free issue was addressed with improved memory management.\n\nCVE-2026-86962: OpenAI, Hüseyin Kabasakal @HuseyinK01\n\nEntry added October 19, 2026\n\n### Kernel\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to execute arbitrary code with kernel privileges\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-86916: Wang Yu\n\nEntry added October 26, 2026\n\n### libarchive\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: A heap buffer overflow was addressed with improved bounds checking.\n\n### Messages\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted image may lead to unexpected process termination\n\nDescription: An input validation issue was addressed with improved input validation.\n\nCVE-2026-86959: an anonymous researcher\n\nEntry added October 19, 2026\n\n### MobileAccessoryUpdater\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Connecting a malicious accessory may cause unexpected system termination\n\nDescription: A memory corruption issue was addressed with improved input validation.\n\nCVE-2026-86924: Matthew Zamat\n\n### MobileBackup\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to modify protected parts of the file system\n\nDescription: A path handling issue was addressed with improved validation.\n\nCVE-2026-65411: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\n### MobileBackup\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n\nDescription: A path traversal issue was addressed with improved path validation.\n\nCVE-2026-84598: Drin Raci of sentry.security\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Opening a maliciously crafted file may lead to unexpected process termination\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-84497: Yiğit Can YILMAZ (@yilmazcanyigit)\n\n### Model I/O\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nCVE-2026-112565: Musaab Khan (@bxff), Saoud Khalifah, stratan (@5tratan), Niels Hofmans, Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\nEntry added October 26, 2026\n\n### Music\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-84615: Stanislav Jelezoglo\n\n### NetworkExtension\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to identify what other apps a user has installed\n\nCVE-2026-84626: Hoffcona of IES Red Team\n\nEntry updated October 19, 2026\n\n### Photos\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-84491: an anonymous researcher\n\n### Power Management\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to fingerprint the device\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-84623: Ilya Andr (andrd3v)\n\n### RealityKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n\nDescription: An out-of-bounds read issue was addressed with improved input validation.\n\nCVE-2026-84532: Franco Belman at Blackwing Intelligence, Hongsik Kim (mnur), stratan (@5tratan)\n\nEntry updated October 26, 2026\n\n### RealityKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-28966: stratan (@5tratan)\n\n### Reminders\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-65403: Rahul Raj\n\n### Safe Browsing\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with additional entitlement checks.\n\nCVE-2026-86897: Stuart Wallace\n\n### SceneKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted file may result in disclosure of process memory\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-84487: stratan (@5tratan), Peter Malone, Dhiyanesh Selvaraj (@redroot97)\n\n### SceneKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84546: Narendra Singh (@_3P1C), stratan (@5tratan), Peter Malone\n\nCVE-2026-84611: Nathaniel Oh (@calysteon)\n\n### SceneKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-84632: Peter Malone\n\n### SceneKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted 3D model may lead to memory corruption\n\nDescription: An integer overflow was addressed with improved input validation.\n\nCVE-2026-84620: Peter Malone\n\n### SceneKit\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing a maliciously crafted 3D scene may lead to unexpected process termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-84526: stratan (@5tratan)\n\n### Security\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n\nDescription: A certificate validation issue was addressed with improved certificate validation.\n\nCVE-2026-86881: Surya Narayan Kushwaha, Roman Zabicki, John Lussier, Filip Olszak\n\n### Siri\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A local attacker may be able to overwrite restricted files\n\nDescription: A permissions issue was addressed with improved validation.\n\nCVE-2026-86921: bubu, Jonghoon Han (Aegis), 이재영, Tae Woo Kim, Dawuge of Shuffle Team\n\nEntry added October 19, 2026\n\n### Siri Suggestions\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker with physical access to a locked device may be able to view sensitive user information\n\nDescription: A logic issue was addressed with improved checks.\n\nCVE-2026-86890: Abhay Kailasia (@abhay_kailasia) from Safran Mumbai India\n\n### Spotlight\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved access control.\n\nCVE-2026-84621: Abodi Dawoud, Ujjwal Reddy Kalvolu Sreenivasa Reddy, Johan Wahyudi, Armend Gashi\n\n### SpringBoard\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to cause a denial-of-service\n\nCVE-2026-86892: Lehan Dilusha Jayasingha\n\n### Storage\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An app may be able to access user-sensitive data\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-65345: 이재영, Seung Je Seong, Jakob Pammer, Ilya Andr (andrd3v) of Positive Technologies\n\n### Storage\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and","published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}