Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "visionOS 27",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-8 visionOS 27\n\nvisionOS 27 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149038.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAPFS\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nApp Store\nAvailable for: Apple Vision Pro (all models)\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86888: Zhongcheng Li (CK01)\n\nApple Account\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to use the Sign In With Apple authentication\nflow to access the user's Apple Account\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-20683: Dem0ns (@天府简易信工作室), Abdelhak Kherroubi, Jasminder Pal\nSingh, Lehan Dilusha Jayasingha (Sri Lanka)\n\nAppleAVD\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik\nTsytsarkin\n\nAuthentication Services\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to delete credentials stored in Keychain\nDescription: This issue was addressed by removing the vulnerable code.\nCVE-2026-86905: Ilya Andr (andrd3v)\n\nAuthKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nAVEVideoEncoder\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved checks.\nCVE-2026-65410: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nAVEVideoEncoder\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-84616: Peter Malone\n\nAVEVideoEncoder\nAvailable for: Apple Vision Pro (all models)\nImpact: A sandboxed app may be able to execute arbitrary code with\nkernel privileges\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84607: Ruslan Dautov\n\nBackgroundAssets\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\nBluetooth\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause unexpected app\ntermination or arbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65414\n\nBluetooth\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may gain unauthorized access to Bluetooth\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84560: an anonymous researcher\n\nCloudKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A local app may be able to read a persistent account identifier\nDescription: An information disclosure issue was addressed with improved\nstate management.\nCVE-2026-86895: Stanislav Jelezoglo\n\nCloudKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to read device name\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86893: Heiner Gerdes\n\ncopyfile\nAvailable for: Apple Vision Pro (all models)\nImpact: An archive may be able to bypass Gatekeeper\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,\nan anonymous researcher\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: A memory corruption issue was addressed by removing the\nvulnerable code.\nCVE-2026-64752: Nik Tsytsarkin\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: A sandboxed process may be able to circumvent sandbox\nrestrictions\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86876: Chris Bailey - Short Circuit\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65344: Siyeong kim\n\nCoreML\nAvailable for: Apple Vision Pro (all models)\nImpact: A sandboxed app may be able to access restricted files\nDescription: A permissions issue was addressed with improved path\nvalidation.\nCVE-2026-84624: AL Najafi, tamdao\n\nCoreText\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing web content may lead to a denial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-65412: Pavan Nallamothu\n\nCoreText\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84596: ret2happy, Meta Product Security\n\nCoreUI\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\nCoreUI\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to unexpected\napp termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-84571: stratan (@5tratan), Peter Malone\n\nCoreUI\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted asset catalog may lead to\nunexpected process termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84511: Rahul Raj, stratan (@5tratan)\n\nDeviceCheck\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to read persistent device identifiers\nDescription: An authorization issue was addressed with improved access\ncontrol.\nCVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill\n(@jjtech@infosec.exchange)\n\nFile Bookmark\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to modify a file it only had permission to\nread\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya\nKumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)\n\nfile_cmds\nAvailable for: Apple Vision Pro (all models)\nImpact: Extracting a maliciously crafted archive may allow an attacker\nto write arbitrary files\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-84534: Geoffrey Lovelace\n\nFontParser\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted font file may lead to\nunexpected app termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84524: an anonymous researcher\n\nFontParser\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read issue was addressed with improved\ninput validation.\nCVE-2026-84597: Nik Tsytsarkin\n\nFoundation\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and\nAnthropic Research\n\nGraphics\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),\nJiyong Yang\n\niCloud\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to identify a user across reinstalls\nDescription: A privacy issue was addressed with improved handling of\nidentifiers.\nCVE-2026-84606: Ilya Andr (andrd3v)\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may result in disclosure\nof process memory\nDescription: An uninitialized memory issue was addressed with improved\nmemory initialization.\nCVE-2026-84564: Justin O'Leary\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may result in memory\ncorruption\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan\n\nIOGPUFamily\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and\n3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi\n\nIOKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, 이재영\n\nIOMobileFrameBuffer\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,\ndbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nIOSurfaceAccelerator\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),\nFranco Belman at Blackwing Intelligence\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-28968: genter0, Svetoslav Stolarov & Aisa Fox, Josh Maine of\nCalif.io, Dun\n"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:32Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/60"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/60"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/149038"
},
{
"url": "https://support.apple.com/kb/HT214009"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/60"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-09-14-2026-8 visionOS 27",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-20683",
"type": "related"
},
{
"destId": "CVE-2026-28935",
"type": "related"
},
{
"destId": "CVE-2026-28966",
"type": "related"
},
{
"destId": "CVE-2026-28968",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-43686",
"type": "related"
},
{
"destId": "CVE-2026-43687",
"type": "related"
},
{
"destId": "CVE-2026-43689",
"type": "related"
},
{
"destId": "CVE-2026-43695",
"type": "related"
},
{
"destId": "CVE-2026-43785",
"type": "related"
},
{
"destId": "CVE-2026-43794",
"type": "related"
},
{
"destId": "CVE-2026-43795",
"type": "related"
},
{
"destId": "CVE-2026-64715",
"type": "related"
},
{
"destId": "CVE-2026-64718",
"type": "related"
},
{
"destId": "CVE-2026-64736",
"type": "related"
},
{
"destId": "CVE-2026-64752",
"type": "related"
},
{
"destId": "CVE-2026-64753",
"type": "related"
},
{
"destId": "CVE-2026-64760",
"type": "related"
},
{
"destId": "CVE-2026-64778",
"type": "related"
},
{
"destId": "CVE-2026-64779",
"type": "related"
},
{
"destId": "CVE-2026-64780",
"type": "related"
},
{
"destId": "CVE-2026-64781",
"type": "related"
},
{
"destId": "CVE-2026-64782",
"type": "related"
},
{
"destId": "CVE-2026-64784",
"type": "related"
},
{
"destId": "CVE-2026-64787",
"type": "related"
},
{
"destId": "CVE-2026-64788",
"type": "related"
},
{
"destId": "CVE-2026-65330",
"type": "related"
},
{
"destId": "CVE-2026-65331",
"type": "related"
},
{
"destId": "CVE-2026-65332",
"type": "related"
},
{
"destId": "CVE-2026-65333",
"type": "related"
},
{
"destId": "CVE-2026-65334",
"type": "related"
},
{
"destId": "CVE-2026-65335",
"type": "related"
},
{
"destId": "CVE-2026-65336",
"type": "related"
},
{
"destId": "CVE-2026-65337",
"type": "related"
},
{
"destId": "CVE-2026-65338",
"type": "related"
},
{
"destId": "CVE-2026-65339",
"type": "related"
},
{
"destId": "CVE-2026-65340",
"type": "related"
},
{
"destId": "CVE-2026-65341",
"type": "related"
},
{
"destId": "CVE-2026-65343",
"type": "related"
},
{
"destId": "CVE-2026-65344",
"type": "related"
},
{
"destId": "CVE-2026-65346",
"type": "related"
},
{
"destId": "CVE-2026-65347",
"type": "related"
},
{
"destId": "CVE-2026-65349",
"type": "related"
},
{
"destId": "CVE-2026-65351",
"type": "related"
},
{
"destId": "CVE-2026-65358",
"type": "related"
},
{
"destId": "CVE-2026-65359",
"type": "related"
},
{
"destId": "CVE-2026-65360",
"type": "related"
},
{
"destId": "CVE-2026-65377",
"type": "related"
},
{
"destId": "CVE-2026-65390",
"type": "related"
},
{
"destId": "CVE-2026-65391",
"type": "related"
},
{
"destId": "CVE-2026-65395",
"type": "related"
},
{
"destId": "CVE-2026-65398",
"type": "related"
},
{
"destId": "CVE-2026-65399",
"type": "related"
},
{
"destId": "CVE-2026-65402",
"type": "related"
},
{
"destId": "CVE-2026-65403",
"type": "related"
},
{
"destId": "CVE-2026-65405",
"type": "related"
},
{
"destId": "CVE-2026-65406",
"type": "related"
},
{
"destId": "CVE-2026-65407",
"type": "related"
},
{
"destId": "CVE-2026-65409",
"type": "related"
},
{
"destId": "CVE-2026-65410",
"type": "related"
},
{
"destId": "CVE-2026-65411",
"type": "related"
},
{
"destId": "CVE-2026-65412",
"type": "related"
},
{
"destId": "CVE-2026-65414",
"type": "related"
},
{
"destId": "CVE-2026-65415",
"type": "related"
},
{
"destId": "CVE-2026-84487",
"type": "related"
},
{
"destId": "CVE-2026-84491",
"type": "related"
},
{
"destId": "CVE-2026-84492",
"type": "related"
},
{
"destId": "CVE-2026-84497",
"type": "related"
},
{
"destId": "CVE-2026-84507",
"type": "related"
},
{
"destId": "CVE-2026-84511",
"type": "related"
},
{
"destId": "CVE-2026-84513",
"type": "related"
},
{
"destId": "CVE-2026-84521",
"type": "related"
},
{
"destId": "CVE-2026-84523",
"type": "related"
},
{
"destId": "CVE-2026-84524",
"type": "related"
},
{
"destId": "CVE-2026-84526",
"type": "related"
},
{
"destId": "CVE-2026-84527",
"type": "related"
},
{
"destId": "CVE-2026-84530",
"type": "related"
},
{
"destId": "CVE-2026-84532",
"type": "related"
},
{
"destId": "CVE-2026-84534",
"type": "related"
},
{
"destId": "CVE-2026-84546",
"type": "related"
},
{
"destId": "CVE-2026-84551",
"type": "related"
},
{
"destId": "CVE-2026-84560",
"type": "related"
},
{
"destId": "CVE-2026-84561",
"type": "related"
},
{
"destId": "CVE-2026-84564",
"type": "related"
},
{
"destId": "CVE-2026-84571",
"type": "related"
},
{
"destId": "CVE-2026-84575",
"type": "related"
},
{
"destId": "CVE-2026-84583",
"type": "related"
},
{
"destId": "CVE-2026-84596",
"type": "related"
},
{
"destId": "CVE-2026-84597",
"type": "related"
},
{
"destId": "CVE-2026-84600",
"type": "related"
},
{
"destId": "CVE-2026-84602",
"type": "related"
},
{
"destId": "CVE-2026-84603",
"type": "related"
},
{
"destId": "CVE-2026-84606",
"type": "related"
},
{
"destId": "CVE-2026-84607",
"type": "related"
},
{
"destId": "CVE-2026-84609",
"type": "related"
},
{
"destId": "CVE-2026-84611",
"type": "related"
},
{
"destId": "CVE-2026-84612",
"type": "related"
},
{
"destId": "CVE-2026-84615",
"type": "related"
},
{
"destId": "CVE-2026-84616",
"type": "related"
},
{
"destId": "CVE-2026-84620",
"type": "related"
},
{
"destId": "CVE-2026-84622",
"type": "related"
},
{
"destId": "CVE-2026-84624",
"type": "related"
},
{
"destId": "CVE-2026-84625",
"type": "related"
},
{
"destId": "CVE-2026-84626",
"type": "related"
},
{
"destId": "CVE-2026-84628",
"type": "related"
},
{
"destId": "CVE-2026-84629",
"type": "related"
},
{
"destId": "CVE-2026-84630",
"type": "related"
},
{
"destId": "CVE-2026-84632",
"type": "related"
},
{
"destId": "CVE-2026-84635",
"type": "related"
},
{
"destId": "CVE-2026-84636",
"type": "related"
},
{
"destId": "CVE-2026-86870",
"type": "related"
},
{
"destId": "CVE-2026-86876",
"type": "related"
},
{
"destId": "CVE-2026-86881",
"type": "related"
},
{
"destId": "CVE-2026-86882",
"type": "related"
},
{
"destId": "CVE-2026-86883",
"type": "related"
},
{
"destId": "CVE-2026-86887",
"type": "related"
},
{
"destId": "CVE-2026-86888",
"type": "related"
},
{
"destId": "CVE-2026-86892",
"type": "related"
},
{
"destId": "CVE-2026-86893",
"type": "related"
},
{
"destId": "CVE-2026-86895",
"type": "related"
},
{
"destId": "CVE-2026-86897",
"type": "related"
},
{
"destId": "CVE-2026-86898",
"type": "related"
},
{
"destId": "CVE-2026-86903",
"type": "related"
},
{
"destId": "CVE-2026-86905",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0398",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/60",
"automated": true,
"contentSha256": "d1a72a0a042e783ac09829d6e2610d4e6db9aa438ec5ede9027011353dc55579",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/60",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-14T22:09:24Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:32Z",
"dateUpdated": "2026-10-02T04:57:32Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0398"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}