Live › vulnerability › CVE-2026-86916
Go to dashboardA use-after-free flaw in the Apple kernel lets a malicious app execute arbitrary code with kernel privileges. Fixed releases are iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7.2.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:55 UTC. All times on this page are UTC.
Any Apple device running an OS build older than the listed fixed releases can be affected. The source describes the flaw as reachable by an app, so any device that runs third-party or untrusted apps is the main concern. Managed fleets that pin older OS versions should treat this as a priority. Devices already on the fixed releases are not affected.
No product ranges from the sources yet.
sw_vers -productVersion and compare with 15.8 (Sequoia) or 26.7.2 (Tahoe).26.7.2, macOS Sequoia 15.8, or macOS Golden Gate 27.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7.2. An app may be able to execute arbitrary code with kernel privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-86916")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.