---
id: "CVE-2026-86988"
kind: "vulnerability"
aliases: ["CVE-2026-86988"]
title: "Apple iOS and macOS: crafted image leaks process memory before 27.2"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["apple", "infrastructure", "ios", "ipados", "macos"]
not_affected_if: []
published_at: "2026-10-26T21:20:37+00:00"
first_seen_at: "2026-10-26T21:55:22+00:00"
updated_at: "2026-10-26T21:56:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86988", "first_seen_at": "2026-10-26T21:55:22+00:00"}]
---

# Apple iOS and macOS: crafted image leaks process memory before 27.2

Apple's image processing in iOS, iPadOS, macOS, tvOS, visionOS and watchOS can be made to disclose process memory when it handles a maliciously crafted image. The sources say the fix is in version 27.2 of each of those systems.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version under Settings > General > About (iOS and iPadOS) or About This Mac (macOS) and compare it with 27.2
- unknown for command-line checks, the sources do not say

## Fix

- Update iOS and iPadOS to `27.2`
- Update macOS Golden Gate to `27.2`
- Update tvOS, visionOS and watchOS to `27.2`

## Timeline

- 2026-10-26T21:55:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86988

## From the sources

The issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_