{"id":"CVE-2026-86944","kind":"vulnerability","aliases":["CVE-2026-86944"],"related":[],"title":"Apple iOS, macOS: out-of-bounds write can crash the system","description":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.","summary":"An out-of-bounds write flaw in Apple's operating systems lets an app trigger an unexpected system termination. The description names only denial of service; it does not say code execution is possible.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","ios","ipados","macos"],"not_affected_if":["already-updated-devices"],"how_to_check":"- Check the device version in Settings > General > About (iOS and iPadOS) or Apple menu > About This Mac (macOS)\n- Compare against the fixed builds: `iOS 26.7`, `iPadOS 26.7`, `macOS Sequoia 15.8`, `macOS Tahoe 26.7`","fix":"- Update iOS and iPadOS to `26.7` or later\n- Update macOS Sequoia to `15.8` or later, and macOS Tahoe to `26.7` or later","status":"open","published_at":"2026-10-20T01:17:28+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T05:06:10+00:00","updated_at":"2026-10-25T05:06:10+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:06:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `26.7` or later\n- Update macOS Sequoia to `15.8` or later, and macOS Tahoe to `26.7` or later","reach":"local","title":"Apple iOS, macOS: out-of-bounds write can crash the system","impact":"low","summary":"An out-of-bounds write flaw in Apple's operating systems lets an app trigger an unexpected system termination. The description names only denial of service; it does not say code execution is possible.","category":"infrastructure","nicknames":[],"who_cares":["ios","ipados","macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A malicious app crashes the system, causing a forced restart.","analyst_note":"","how_to_check":"- Check the device version in Settings > General > About (iOS and iPadOS) or Apple menu > About This Mac (macOS)\n- Compare against the fixed builds: `iOS 26.7`, `iPadOS 26.7`, `macOS Sequoia 15.8`, `macOS Tahoe 26.7`","needs_analyst":false,"not_affected_if":["already-updated-devices"],"who_is_affected":"Anyone running Apple devices on the affected builds before the fix, including managed fleets that report OS versions. The sources do not describe a specific data path or app that makes a device more exposed. unknown whether non-default configurations matter.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000591,"input_tokens":3288,"output_tokens":525,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86944':15A,18A '15.8':86C '26.7':80C,83C,89C 'abl':94C 'address':69C 'app':40B,91C 'appl':1A,20B,34B 'apple-devic':19B 'bound':7A,30B,65C,72C 'caus':96C 'check':73C 'code':57B 'crash':10A 'cve':13A,16A 'denial':50B 'descript':47B 'devic':21B 'execut':58B 'fix':77C 'flaw':32B 'improv':71C 'infrastructur':22B 'io':2A,23B,79C 'ipado':24B,82C 'issu':67C,75C 'let':38B 'maco':3A,25B,84C,87C 'may':92C 'name':48B 'oper':36B 'out-of-bound':4A,27B,62C 'possibl':60B 'say':56B 'sequoia':85C 'servic':52B 'system':12A,37B,44B,98C 'taho':88C 'termin':45B,99C 'trigger':41B 'unexpect':43B,97C 'write':8A,31B,66C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Apple devices on the affected builds before the fix, including managed fleets that report OS versions. The sources do not describe a specific data path or app that makes a device more exposed. unknown whether non-default configurations matter.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86944","severity":null,"published_at":"2026-10-20T01:17:28+00:00","modified_at":"2026-10-20T15:03:59+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}