Description (en)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-1 iOS 27 and iPadOS 27
iOS 27 and iPadOS 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149034.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: Processing a maliciously crafted image may lead to unexpected
process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86882: Peter Malone
Accessibility
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of
Totally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,
Asaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)
Accessibility
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to identify what other apps a user has
installed
Description: A privacy issue was addressed with improved handling of
user preferences.
CVE-2026-64761: Stuart Wallace, Sindre Sorhus
Accounts
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: A malicious application may be able to bypass Privacy
preferences
Description: An authorization issue was addressed with improved state
management.
CVE-2026-65404: Arni Hardarson (Neonix Security), Vinay Kumar Rasala
(Xplo8E) from Appknox, Stuart Wallace, 이재영
APFS
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher
App Store
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86888: Zhongcheng Li (CK01)
Apple Account
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to use the Sign In With Apple authentication
flow to access the user's Apple Account
Description: An authentication issue was addressed with improved state
management.
CVE-2026-20683: Dem0ns (@天府简易信工作室), Abdelhak Kherroubi, Jasminder Pal
Singh, Lehan Dilusha Jayasingha (Sri Lanka)
Apple Neural Engine
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-65408: tamdao
AppleAVD
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
AppleDouble
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: Mounting a disk image with maliciously crafted files may lead to
unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84519: Richard Zana
AppleKeyStore
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-84593: Meta Red Team X - Nik Tsytsarkin, Alexandre Borges
Authentication Services
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to delete credentials stored in Keychain
Description: This issue was addressed by removing the vulnerable code.
CVE-2026-86905: Ilya Andr (andrd3v)
AuthKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84583: Zhongcheng Li from IES Red Team
AVEVideoEncoder
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved checks.
CVE-2026-65410: Calif.io <http://calif.io/> in collaboration with Claude and Anthropic
Research
AVEVideoEncoder
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-84616: Peter Malone
AVEVideoEncoder
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: A sandboxed app may be able to execute arbitrary code with
kernel privileges
Description: A race condition was addressed with improved state
management.
CVE-2026-84607: Ruslan Dautov
BackgroundAssets
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved validation.
CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security
Baseband
Available for: iPhone 11 and later
Impact: An attacker in radio range may be able to cause unexpected
system termination
Description: An input validation issue was addressed with improved input
validation.
CVE-2026-86885: Tuan D. Hoang, Hazem Issa, and Yongdae Kim @ KAIST
SysSec Lab
Baseband
Available for: iPhone 11 and later
Impact: A remote attacker may be able to cause a denial-of-service
Description: A denial-of-service issue was addressed with improved input
validation.
CVE-2026-86879: Hazem Issa and Yongdae Kim @ SysSec, KAIST
Bluetooth
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: A remote attacker may be able to cause unexpected app
termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65414
Bluetooth
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may gain unauthorized access to Bluetooth
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84560: an anonymous researcher
Camera
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86878: Sindre Sorhus, Ilya Andr (andrd3v) of Positive
Technologies, Asaf Cohen
CloudKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: A local app may be able to read a persistent account identifier
Description: An information disclosure issue was addressed with improved
state management.
CVE-2026-86895: Stanislav Jelezoglo
CloudKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An app may be able to read device name
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86893: Heiner Gerdes
copyfile
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: An archive may be able to bypass Gatekeeper
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,
an anonymous researcher
CoreMedia
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9th generation and later, and iPad mini 6th
generation and later
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A memory corruption issue was addressed by removing the
vulnerable code.
CVE-2026-64752: Nik Tsytsarkin
CoreMedia
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th
generation and later, iPad 9
Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "iOS 27 and",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-1 iOS 27 and iPadOS 27\n\niOS 27 and iPadOS 27 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149034.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAccessibility\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of\nTotally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,\nAsaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)\n\nAccessibility\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to identify what other apps a user has\ninstalled\nDescription: A privacy issue was addressed with improved handling of\nuser preferences.\nCVE-2026-64761: Stuart Wallace, Sindre Sorhus\n\nAccounts\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: A malicious application may be able to bypass Privacy\npreferences\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-65404: Arni Hardarson (Neonix Security), Vinay Kumar Rasala\n(Xplo8E) from Appknox, Stuart Wallace, 이재영\n\nAPFS\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nApp Store\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86888: Zhongcheng Li (CK01)\n\nApple Account\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to use the Sign In With Apple authentication\nflow to access the user's Apple Account\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-20683: Dem0ns (@天府简易信工作室), Abdelhak Kherroubi, Jasminder Pal\nSingh, Lehan Dilusha Jayasingha (Sri Lanka)\n\nApple Neural Engine\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65408: tamdao\n\nAppleAVD\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAppleDouble\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: Mounting a disk image with maliciously crafted files may lead to\nunexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84519: Richard Zana\n\nAppleKeyStore\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-84593: Meta Red Team X - Nik Tsytsarkin, Alexandre Borges\n\nAuthentication Services\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to delete credentials stored in Keychain\nDescription: This issue was addressed by removing the vulnerable code.\nCVE-2026-86905: Ilya Andr (andrd3v)\n\nAuthKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nAVEVideoEncoder\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved checks.\nCVE-2026-65410: Calif.io <http://calif.io/> in collaboration with Claude and Anthropic\nResearch\n\nAVEVideoEncoder\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-84616: Peter Malone\n\nAVEVideoEncoder\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: A sandboxed app may be able to execute arbitrary code with\nkernel privileges\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84607: Ruslan Dautov\n\nBackgroundAssets\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\nBaseband\nAvailable for: iPhone 11 and later\nImpact: An attacker in radio range may be able to cause unexpected\nsystem termination\nDescription: An input validation issue was addressed with improved input\nvalidation.\nCVE-2026-86885: Tuan D. Hoang, Hazem Issa, and Yongdae Kim @ KAIST\nSysSec Lab\n\nBaseband\nAvailable for: iPhone 11 and later\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: A denial-of-service issue was addressed with improved input\nvalidation.\nCVE-2026-86879: Hazem Issa and Yongdae Kim @ SysSec, KAIST\n\nBluetooth\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: A remote attacker may be able to cause unexpected app\ntermination or arbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65414\n\nBluetooth\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may gain unauthorized access to Bluetooth\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84560: an anonymous researcher\n\nCamera\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86878: Sindre Sorhus, Ilya Andr (andrd3v) of Positive\nTechnologies, Asaf Cohen\n\nCloudKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: An information disclosure issue was addressed with improved\nstate management.\nCVE-2026-86895: Stanislav Jelezoglo\n\nCloudKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An app may be able to read device name\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86893: Heiner Gerdes\n\ncopyfile\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: An archive may be able to bypass Gatekeeper\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,\nan anonymous researcher\n\nCoreMedia\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9th generation and later, and iPad mini 6th\ngeneration and later\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: A memory corruption issue was addressed by removing the\nvulnerable code.\nCVE-2026-64752: Nik Tsytsarkin\n\nCoreMedia\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation\nand later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th\ngeneration and later, iPad 9"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:27Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/53"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/53"
},
{
"url": "http://aipyaipy.com/"
},
{
"url": "http://balintmagyar.com/"
},
{
"url": "http://calif.io/"
},
{
"url": "http://github.com/sai2fast"
},
{
"url": "http://jakederouin.com/"
},
{
"url": "http://jylab.github.io/"
},
{
"url": "http://linkedin.com/in/barathstalin"
},
{
"url": "http://linkedin.com/in/manojkumar-j-7ba35b202/"
},
{
"url": "http://onymos.com/"
},
{
"url": "http://paradisefacade.com/"
},
{
"url": "http://rokita.me/"
},
{
"url": "http://striga.ai/"
},
{
"url": "http://x.com/weezerOSINT"
},
{
"url": "http://xint.io/"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/149034"
},
{
"url": "https://www.apple.com/itunes/"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/53"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-09-14-2026-1 iOS 27 and iPadOS 27",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-20683",
"type": "related"
},
{
"destId": "CVE-2026-28966",
"type": "related"
},
{
"destId": "CVE-2026-28968",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-43664",
"type": "related"
},
{
"destId": "CVE-2026-43674",
"type": "related"
},
{
"destId": "CVE-2026-43686",
"type": "related"
},
{
"destId": "CVE-2026-43687",
"type": "related"
},
{
"destId": "CVE-2026-43688",
"type": "related"
},
{
"destId": "CVE-2026-43689",
"type": "related"
},
{
"destId": "CVE-2026-43695",
"type": "related"
},
{
"destId": "CVE-2026-43737",
"type": "related"
},
{
"destId": "CVE-2026-43738",
"type": "related"
},
{
"destId": "CVE-2026-43785",
"type": "related"
},
{
"destId": "CVE-2026-64718",
"type": "related"
},
{
"destId": "CVE-2026-64752",
"type": "related"
},
{
"destId": "CVE-2026-64753",
"type": "related"
},
{
"destId": "CVE-2026-64756",
"type": "related"
},
{
"destId": "CVE-2026-64760",
"type": "related"
},
{
"destId": "CVE-2026-64761",
"type": "related"
},
{
"destId": "CVE-2026-65329",
"type": "related"
},
{
"destId": "CVE-2026-65344",
"type": "related"
},
{
"destId": "CVE-2026-65345",
"type": "related"
},
{
"destId": "CVE-2026-65348",
"type": "related"
},
{
"destId": "CVE-2026-65354",
"type": "related"
},
{
"destId": "CVE-2026-65358",
"type": "related"
},
{
"destId": "CVE-2026-65359",
"type": "related"
},
{
"destId": "CVE-2026-65360",
"type": "related"
},
{
"destId": "CVE-2026-65377",
"type": "related"
},
{
"destId": "CVE-2026-65395",
"type": "related"
},
{
"destId": "CVE-2026-65398",
"type": "related"
},
{
"destId": "CVE-2026-65399",
"type": "related"
},
{
"destId": "CVE-2026-65402",
"type": "related"
},
{
"destId": "CVE-2026-65403",
"type": "related"
},
{
"destId": "CVE-2026-65404",
"type": "related"
},
{
"destId": "CVE-2026-65405",
"type": "related"
},
{
"destId": "CVE-2026-65406",
"type": "related"
},
{
"destId": "CVE-2026-65407",
"type": "related"
},
{
"destId": "CVE-2026-65408",
"type": "related"
},
{
"destId": "CVE-2026-65409",
"type": "related"
},
{
"destId": "CVE-2026-65410",
"type": "related"
},
{
"destId": "CVE-2026-65411",
"type": "related"
},
{
"destId": "CVE-2026-65412",
"type": "related"
},
{
"destId": "CVE-2026-65414",
"type": "related"
},
{
"destId": "CVE-2026-65415",
"type": "related"
},
{
"destId": "CVE-2026-84487",
"type": "related"
},
{
"destId": "CVE-2026-84489",
"type": "related"
},
{
"destId": "CVE-2026-84491",
"type": "related"
},
{
"destId": "CVE-2026-84492",
"type": "related"
},
{
"destId": "CVE-2026-84497",
"type": "related"
},
{
"destId": "CVE-2026-84507",
"type": "related"
},
{
"destId": "CVE-2026-84510",
"type": "related"
},
{
"destId": "CVE-2026-84511",
"type": "related"
},
{
"destId": "CVE-2026-84513",
"type": "related"
},
{
"destId": "CVE-2026-84518",
"type": "related"
},
{
"destId": "CVE-2026-84519",
"type": "related"
},
{
"destId": "CVE-2026-84521",
"type": "related"
},
{
"destId": "CVE-2026-84523",
"type": "related"
},
{
"destId": "CVE-2026-84524",
"type": "related"
},
{
"destId": "CVE-2026-84526",
"type": "related"
},
{
"destId": "CVE-2026-84527",
"type": "related"
},
{
"destId": "CVE-2026-84530",
"type": "related"
},
{
"destId": "CVE-2026-84531",
"type": "related"
},
{
"destId": "CVE-2026-84532",
"type": "related"
},
{
"destId": "CVE-2026-84533",
"type": "related"
},
{
"destId": "CVE-2026-84534",
"type": "related"
},
{
"destId": "CVE-2026-84546",
"type": "related"
},
{
"destId": "CVE-2026-84551",
"type": "related"
},
{
"destId": "CVE-2026-84552",
"type": "related"
},
{
"destId": "CVE-2026-84560",
"type": "related"
},
{
"destId": "CVE-2026-84561",
"type": "related"
},
{
"destId": "CVE-2026-84564",
"type": "related"
},
{
"destId": "CVE-2026-84566",
"type": "related"
},
{
"destId": "CVE-2026-84571",
"type": "related"
},
{
"destId": "CVE-2026-84575",
"type": "related"
},
{
"destId": "CVE-2026-84583",
"type": "related"
},
{
"destId": "CVE-2026-84593",
"type": "related"
},
{
"destId": "CVE-2026-84596",
"type": "related"
},
{
"destId": "CVE-2026-84597",
"type": "related"
},
{
"destId": "CVE-2026-84598",
"type": "related"
},
{
"destId": "CVE-2026-84600",
"type": "related"
},
{
"destId": "CVE-2026-84602",
"type": "related"
},
{
"destId": "CVE-2026-84603",
"type": "related"
},
{
"destId": "CVE-2026-84606",
"type": "related"
},
{
"destId": "CVE-2026-84607",
"type": "related"
},
{
"destId": "CVE-2026-84609",
"type": "related"
},
{
"destId": "CVE-2026-84611",
"type": "related"
},
{
"destId": "CVE-2026-84612",
"type": "related"
},
{
"destId": "CVE-2026-84615",
"type": "related"
},
{
"destId": "CVE-2026-84616",
"type": "related"
},
{
"destId": "CVE-2026-84617",
"type": "related"
},
{
"destId": "CVE-2026-84620",
"type": "related"
},
{
"destId": "CVE-2026-84621",
"type": "related"
},
{
"destId": "CVE-2026-84622",
"type": "related"
},
{
"destId": "CVE-2026-84623",
"type": "related"
},
{
"destId": "CVE-2026-84624",
"type": "related"
},
{
"destId": "CVE-2026-84625",
"type": "related"
},
{
"destId": "CVE-2026-84626",
"type": "related"
},
{
"destId": "CVE-2026-84628",
"type": "related"
},
{
"destId": "CVE-2026-84629",
"type": "related"
},
{
"destId": "CVE-2026-84630",
"type": "related"
},
{
"destId": "CVE-2026-84632",
"type": "related"
},
{
"destId": "CVE-2026-84635",
"type": "related"
},
{
"destId": "CVE-2026-84636",
"type": "related"
},
{
"destId": "CVE-2026-86870",
"type": "related"
},
{
"destId": "CVE-2026-86876",
"type": "related"
},
{
"destId": "CVE-2026-86878",
"type": "related"
},
{
"destId": "CVE-2026-86879",
"type": "related"
},
{
"destId": "CVE-2026-86881",
"type": "related"
},
{
"destId": "CVE-2026-86882",
"type": "related"
},
{
"destId": "CVE-2026-86883",
"type": "related"
},
{
"destId": "CVE-2026-86884",
"type": "related"
},
{
"destId": "CVE-2026-86885",
"type": "related"
},
{
"destId": "CVE-2026-86886",
"type": "related"
},
{
"destId": "CVE-2026-86887",
"type": "related"
},
{
"destId": "CVE-2026-86888",
"type": "related"
},
{
"destId": "CVE-2026-86890",
"type": "related"
},
{
"destId": "CVE-2026-86892",
"type": "related"
},
{
"destId": "CVE-2026-86893",
"type": "related"
},
{
"destId": "CVE-2026-86895",
"type": "related"
},
{
"destId": "CVE-2026-86897",
"type": "related"
},
{
"destId": "CVE-2026-86898",
"type": "related"
},
{
"destId": "CVE-2026-86903",
"type": "related"
},
{
"destId": "CVE-2026-86904",
"type": "related"
},
{
"destId": "CVE-2026-86905",
"type": "related"
},
{
"destId": "CVE-2026-86924",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0391",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/53",
"automated": true,
"contentSha256": "15ade8acdb821fc448b0669e7818dc9fd9bf0f7a21a864c8824d69f216fd4157",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/53",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-14T21:46:43Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:27Z",
"dateUpdated": "2026-10-02T04:57:27Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0391"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}