Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "tvOS 27",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-6 tvOS 27\n\ntvOS 27 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149036.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAccessibility\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of\nTotally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,\nAsaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)\n\nAPFS\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nApp Store\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86888: Zhongcheng Li (CK01)\n\nAppleAVD\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAudio\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik\nTsytsarkin\n\nAuthKit\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nAVEVideoEncoder\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved checks.\nCVE-2026-65410: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nAVEVideoEncoder\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-84616: Peter Malone\n\nAVEVideoEncoder\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A sandboxed app may be able to execute arbitrary code with\nkernel privileges\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84607: Ruslan Dautov\n\nBackgroundAssets\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to access sensitive user data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\nBluetooth\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A remote attacker may be able to cause unexpected app\ntermination or arbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65414\n\nBluetooth\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may gain unauthorized access to Bluetooth\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84560: an anonymous researcher\n\nCloudKit\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: An information disclosure issue was addressed with improved\nstate management.\nCVE-2026-86895: Stanislav Jelezoglo\n\nCloudKit\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to read device name\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86893: Heiner Gerdes\n\nCoreMedia\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65344: Siyeong kim\n\nCoreMotion\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to access motion data from headphones without\nuser consent\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-43737: Stuart Wallace\n\nCoreText\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84596: ret2happy, Meta Product Security\n\nCoreUI\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\nCoreUI\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted image may lead to unexpected\napp termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-84571: stratan (@5tratan), Peter Malone\n\nCoreUI\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted asset catalog may lead to\nunexpected process termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84511: Rahul Raj, stratan (@5tratan)\n\nDeviceCheck\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to read persistent device identifiers\nDescription: An authorization issue was addressed with improved access\ncontrol.\nCVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill\n(@jjtech@infosec.exchange)\n\nFile Bookmark\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to modify a file it only had permission to\nread\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya\nKumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)\n\nFontParser\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted font file may lead to\nunexpected app termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84524: an anonymous researcher\n\nFontParser\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read issue was addressed with improved\ninput validation.\nCVE-2026-84597: Nik Tsytsarkin\n\nFoundation\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and\nAnthropic Research\n\nGraphics\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),\nJiyong Yang\n\nHeimdal\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An attacker in a privileged network position may be able to\nmodify network traffic\nDescription: A cryptographic issue was addressed with improved integrity\nchecks.\nCVE-2026-84533: Vishal Patidar, Roman Zabicki\n\nImageIO\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted image may result in disclosure\nof process memory\nDescription: An uninitialized memory issue was addressed with improved\nmemory initialization.\nCVE-2026-84564: Justin O'Leary\n\nImageIO\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nImageIO\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted image may result in memory\ncorruption\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan\n\nIOKit\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, 이재영\n\nIOMobileFrameBuffer\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,\ndbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nIOSurfaceAccelerator\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),\nFranco Belman at Blackwing Intelligence\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-28968: genter0, Svetoslav Stolarov & Aisa Fox, Josh Maine of\nCalif.io, Dun\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A race condition was addressed with additional validation.\nCVE-2026-65415: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation.\nCVE-2026-65349: an anonymous researcher\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A double free issue was addressed with improved memory\nmanagement.\nCVE-2026-84561: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Bhaswanth Chigurupati\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-84630: Tristan Madani (@TristanInSec) from Talence Security\nCVE-2026-"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:30Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/58"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/58"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/149036"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/58"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-09-14-2026-6 tvOS 27",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-28935",
"type": "related"
},
{
"destId": "CVE-2026-28966",
"type": "related"
},
{
"destId": "CVE-2026-28968",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-43664",
"type": "related"
},
{
"destId": "CVE-2026-43686",
"type": "related"
},
{
"destId": "CVE-2026-43687",
"type": "related"
},
{
"destId": "CVE-2026-43695",
"type": "related"
},
{
"destId": "CVE-2026-43737",
"type": "related"
},
{
"destId": "CVE-2026-43785",
"type": "related"
},
{
"destId": "CVE-2026-43794",
"type": "related"
},
{
"destId": "CVE-2026-64715",
"type": "related"
},
{
"destId": "CVE-2026-64736",
"type": "related"
},
{
"destId": "CVE-2026-64753",
"type": "related"
},
{
"destId": "CVE-2026-64760",
"type": "related"
},
{
"destId": "CVE-2026-64778",
"type": "related"
},
{
"destId": "CVE-2026-64787",
"type": "related"
},
{
"destId": "CVE-2026-65330",
"type": "related"
},
{
"destId": "CVE-2026-65339",
"type": "related"
},
{
"destId": "CVE-2026-65341",
"type": "related"
},
{
"destId": "CVE-2026-65343",
"type": "related"
},
{
"destId": "CVE-2026-65344",
"type": "related"
},
{
"destId": "CVE-2026-65346",
"type": "related"
},
{
"destId": "CVE-2026-65347",
"type": "related"
},
{
"destId": "CVE-2026-65349",
"type": "related"
},
{
"destId": "CVE-2026-65358",
"type": "related"
},
{
"destId": "CVE-2026-65359",
"type": "related"
},
{
"destId": "CVE-2026-65360",
"type": "related"
},
{
"destId": "CVE-2026-65377",
"type": "related"
},
{
"destId": "CVE-2026-65390",
"type": "related"
},
{
"destId": "CVE-2026-65391",
"type": "related"
},
{
"destId": "CVE-2026-65395",
"type": "related"
},
{
"destId": "CVE-2026-65398",
"type": "related"
},
{
"destId": "CVE-2026-65402",
"type": "related"
},
{
"destId": "CVE-2026-65405",
"type": "related"
},
{
"destId": "CVE-2026-65406",
"type": "related"
},
{
"destId": "CVE-2026-65407",
"type": "related"
},
{
"destId": "CVE-2026-65409",
"type": "related"
},
{
"destId": "CVE-2026-65410",
"type": "related"
},
{
"destId": "CVE-2026-65414",
"type": "related"
},
{
"destId": "CVE-2026-65415",
"type": "related"
},
{
"destId": "CVE-2026-84487",
"type": "related"
},
{
"destId": "CVE-2026-84491",
"type": "related"
},
{
"destId": "CVE-2026-84492",
"type": "related"
},
{
"destId": "CVE-2026-84497",
"type": "related"
},
{
"destId": "CVE-2026-84507",
"type": "related"
},
{
"destId": "CVE-2026-84511",
"type": "related"
},
{
"destId": "CVE-2026-84513",
"type": "related"
},
{
"destId": "CVE-2026-84523",
"type": "related"
},
{
"destId": "CVE-2026-84524",
"type": "related"
},
{
"destId": "CVE-2026-84526",
"type": "related"
},
{
"destId": "CVE-2026-84527",
"type": "related"
},
{
"destId": "CVE-2026-84530",
"type": "related"
},
{
"destId": "CVE-2026-84532",
"type": "related"
},
{
"destId": "CVE-2026-84533",
"type": "related"
},
{
"destId": "CVE-2026-84546",
"type": "related"
},
{
"destId": "CVE-2026-84560",
"type": "related"
},
{
"destId": "CVE-2026-84561",
"type": "related"
},
{
"destId": "CVE-2026-84564",
"type": "related"
},
{
"destId": "CVE-2026-84571",
"type": "related"
},
{
"destId": "CVE-2026-84575",
"type": "related"
},
{
"destId": "CVE-2026-84583",
"type": "related"
},
{
"destId": "CVE-2026-84596",
"type": "related"
},
{
"destId": "CVE-2026-84597",
"type": "related"
},
{
"destId": "CVE-2026-84600",
"type": "related"
},
{
"destId": "CVE-2026-84602",
"type": "related"
},
{
"destId": "CVE-2026-84607",
"type": "related"
},
{
"destId": "CVE-2026-84609",
"type": "related"
},
{
"destId": "CVE-2026-84611",
"type": "related"
},
{
"destId": "CVE-2026-84612",
"type": "related"
},
{
"destId": "CVE-2026-84615",
"type": "related"
},
{
"destId": "CVE-2026-84616",
"type": "related"
},
{
"destId": "CVE-2026-84617",
"type": "related"
},
{
"destId": "CVE-2026-84620",
"type": "related"
},
{
"destId": "CVE-2026-84622",
"type": "related"
},
{
"destId": "CVE-2026-84626",
"type": "related"
},
{
"destId": "CVE-2026-84628",
"type": "related"
},
{
"destId": "CVE-2026-84629",
"type": "related"
},
{
"destId": "CVE-2026-84630",
"type": "related"
},
{
"destId": "CVE-2026-84632",
"type": "related"
},
{
"destId": "CVE-2026-84635",
"type": "related"
},
{
"destId": "CVE-2026-84636",
"type": "related"
},
{
"destId": "CVE-2026-86881",
"type": "related"
},
{
"destId": "CVE-2026-86882",
"type": "related"
},
{
"destId": "CVE-2026-86884",
"type": "related"
},
{
"destId": "CVE-2026-86888",
"type": "related"
},
{
"destId": "CVE-2026-86893",
"type": "related"
},
{
"destId": "CVE-2026-86895",
"type": "related"
},
{
"destId": "CVE-2026-86903",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0396",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/58",
"automated": true,
"contentSha256": "17dd0ec9f57afe1ffc10461f3711f60920deb25f184989429dfef2ad399bdd83",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/58",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-14T22:08:11Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:30Z",
"dateUpdated": "2026-10-02T04:57:30Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0396"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}