CVE-2026-86969
Low risk· EPSS 14%Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
An out-of-bounds write was addressed with improved input validation. An app may be able to cause unexpected system termination or corrupt kernel memory. The issue affects iOS/iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.
Risk Assessment
A malicious app could corrupt kernel memory, potentially leading to system instability or privilege escalation. Risk applies to devices running unpatched systems.
Recommendation
Update systems to the specified versions. Restrict app installation to trusted sources.
Other vulnerabilities in Apple iOS/iPadOS/macOS
See all- CVE-2026-86950HighActively exploited
An out-of-bounds write issue in Apple products was addressed with improved bounds checking. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
- CVE-2026-64762Critical
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.
- CVE-2026-64738Critical
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to break out of its sandbox.
- CVE-2026-64695Critical
The issue was addressed with improved memory handling. The vulnerability affects Apple systems and may allow a remote user to cause unexpected system termination or corrupt kernel memory.
- CVE-2026-43757Critical
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.
- CVE-2026-28819Medium
An out-of-bounds write issue was addressed with improved bounds checking. The issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5. An app may be able to execute arbitrary code with kernel privileges.
- CVE-2023-41991MediumActively exploited
A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
- CVE-2023-41064HighActively exploited
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2022-32894HighActively exploited
An out-of-bounds write issue in Apple systems was addressed with improved bounds checking. This affects iOS 15.6.1, iPadOS 15.6.1, and macOS Monterey 12.5.1. An application may execute arbitrary code with kernel privileges.
- CVE-2022-22587CriticalActively exploited
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges; Apple is aware of a report that this issue may have been actively exploited.
Original NVD description (English source)
An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS