Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-64715 (GCVE-0-2026-64715)
Vulnerability from cvelistv5 – Published: 2026-08-17 21:29 – Updated: 2026-09-14 20:47
VLAI
EPSS
VEX
Summary
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process crash.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 13:21 UTC
CWE
- Processing maliciously crafted web content may lead to an unexpected process crash
- CWE-416 - Use After Free
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Apple | Safari |
Affected:
0 , < 26.6.1
(custom)
|
guessed | |
| Apple | iOS and iPadOS |
Affected:
0 , < 18.7.10
(custom)
Affected: 0 , < 26.6.1 (custom) |
guessed | |
| Apple | macOS |
Affected:
0 , < 26.6.2
(custom)
|
guessed | |
| Apple | tvOS |
Affected:
0 , < 27
(custom)
|
guessed | |
| Apple | visionOS |
Affected:
0 , < 27
(custom)
|
guessed | |
| Apple | watchOS |
Affected:
0 , < 27
(custom)
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64715",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T13:21:36.342847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T13:21:43.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Safari",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.6.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.7.10",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.6.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.6.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process crash."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Processing maliciously crafted web content may lead to an unexpected process crash",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:47:52.858Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/148281"
},
{
"url": "https://support.apple.com/en-us/148282"
},
{
"url": "https://support.apple.com/en-us/148286"
},
{
"url": "https://support.apple.com/en-us/148287"
},
{
"url": "https://support.apple.com/en-us/149036"
},
{
"url": "https://support.apple.com/en-us/149037"
},
{
"url": "https://support.apple.com/en-us/149038"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-64715",
"datePublished": "2026-08-17T21:29:27.827Z",
"dateReserved": "2026-07-20T18:09:35.084Z",
"dateUpdated": "2026-09-14T20:47:52.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-64715",
"date": "2026-10-03",
"epss": "0.00393",
"percentile": "0.31154"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "Safari",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.6.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.7.10",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.6.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.6.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"source": "product-security@apple.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E28B5C94-2DF4-4601-B097-582626C761AA",
"versionEndExcluding": "26.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F413C997-517E-4C4F-9506-B7295E94CFFD",
"versionEndExcluding": "18.7.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
"matchCriteriaId": "79392FA7-F634-496F-866F-6D054133D23B",
"versionEndExcluding": "26.6.1",
"versionStartIncluding": "26.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "23D4A4CC-51AE-44CA-A211-5B1A7445E45B",
"versionEndExcluding": "18.7.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8C87B1B6-8A8F-4165-BC18-DE36DE5891C9",
"versionEndExcluding": "26.6.1",
"versionStartIncluding": "26.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ECE169FD-8BEB-45FE-82CE-FC98AD8EB3CA",
"versionEndExcluding": "26.6.2",
"versionStartIncluding": "26.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected process crash."
}
],
"id": "CVE-2026-64715",
"lastModified": "2026-09-14T21:17:14.173",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-64715",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T13:21:36.342847Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-17T22:17:17.343",
"references": [
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/148281"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/148282"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/148286"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/148287"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/149036"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/149037"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/149038"
}
],
"sourceIdentifier": "product-security@apple.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-416"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-09-30T22:55:46+00:00",
"cve": "CVE-2026-64715",
"id": "CVE-2026-64715",
"initial_release_date": "2026-08-17T21:29:27.827000+00:00",
"product_status:fixed": "92",
"product_status:known_affected": "11",
"product_status:known_not_affected": "5",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64715.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-64715",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T13:21:36.342847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T13:21:23.452Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Safari",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.6.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.7.10",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.6.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.6.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process crash."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Processing maliciously crafted web content may lead to an unexpected process crash",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:59:21.972Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/148281"
},
{
"url": "https://support.apple.com/en-us/148282"
},
{
"url": "https://support.apple.com/en-us/148286"
},
{
"url": "https://support.apple.com/en-us/148287"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-64715",
"datePublished": "2026-08-17T21:29:27.827Z",
"dateReserved": "2026-07-20T18:09:35.084Z",
"dateUpdated": "2026-08-18T17:59:21.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
GCVE-1988-2026-0396
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
APPLE-SA-09-14-2026-6 tvOS 27
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-6 tvOS 27
tvOS 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149036.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted image may lead to unexpected
process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86882: Peter Malone
Accessibility
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of
Totally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,
Asaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)
APFS
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher
App Store
Available for: Apple TV 4K 2nd generation and later
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86888: Zhongcheng Li (CK01)
AppleAVD
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
Audio
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to leak sensitive user information
Description: A logic issue was addressed with improved checks.
CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik
Tsytsarkin
AuthKit
Available for: Apple TV 4K 2nd generation and later
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84583: Zhongcheng Li from IES Red Team
AVEVideoEncoder
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved checks.
CVE-2026-65410: Calif.io in collaboration with Claude and Anthropic
Research
AVEVideoEncoder
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-84616: Peter Malone
AVEVideoEncoder
Available for: Apple TV 4K 2nd generation and later
Impact: A sandboxed app may be able to execute arbitrary code with
kernel privileges
Description: A race condition was addressed with improved state
management.
CVE-2026-84607: Ruslan Dautov
BackgroundAssets
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved validation.
CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security
Bluetooth
Available for: Apple TV 4K 2nd generation and later
Impact: A remote attacker may be able to cause unexpected app
termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65414
Bluetooth
Available for: Apple TV 4K 2nd generation and later
Impact: An app may gain unauthorized access to Bluetooth
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84560: an anonymous researcher
CloudKit
Available for: Apple TV 4K 2nd generation and later
Impact: A local app may be able to read a persistent account identifier
Description: An information disclosure issue was addressed with improved
state management.
CVE-2026-86895: Stanislav Jelezoglo
CloudKit
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to read device name
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86893: Heiner Gerdes
CoreMedia
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65344: Siyeong kim
CoreMotion
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to access motion data from headphones without
user consent
Description: An authorization issue was addressed with improved
validation.
CVE-2026-43737: Stuart Wallace
CoreText
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84596: ret2happy, Meta Product Security
CoreUI
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)
CoreUI
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted image may lead to unexpected
app termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-84571: stratan (@5tratan), Peter Malone
CoreUI
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted asset catalog may lead to
unexpected process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84511: Rahul Raj, stratan (@5tratan)
DeviceCheck
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to read persistent device identifiers
Description: An authorization issue was addressed with improved access
control.
CVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill
(@jjtech@infosec.exchange)
File Bookmark
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to modify a file it only had permission to
read
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya
Kumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)
FontParser
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted font file may lead to
unexpected app termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84524: an anonymous researcher
FontParser
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read issue was addressed with improved
input validation.
CVE-2026-84597: Nik Tsytsarkin
Foundation
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause a denial of service
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and
Anthropic Research
Graphics
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),
Jiyong Yang
Heimdal
Available for: Apple TV 4K 2nd generation and later
Impact: An attacker in a privileged network position may be able to
modify network traffic
Description: A cryptographic issue was addressed with improved integrity
checks.
CVE-2026-84533: Vishal Patidar, Roman Zabicki
ImageIO
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted image may result in disclosure
of process memory
Description: An uninitialized memory issue was addressed with improved
memory initialization.
CVE-2026-84564: Justin O'Leary
ImageIO
Available for: Apple TV 4K 2nd generation and later
Impact: Processing an image may lead to a denial-of-service
Description: The issue was addressed with improved checks.
CVE-2026-65347: Geonha Lee (@leegn4a)
ImageIO
Available for: Apple TV 4K 2nd generation and later
Impact: Processing an image may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-65346: Meta Red Team X - Nik Tsytsarkin
ImageIO
Available for: Apple TV 4K 2nd generation and later
Impact: Processing a maliciously crafted image may result in memory
corruption
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan
IOKit
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, 이재영
IOMobileFrameBuffer
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,
dbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin
CVE-2026-64736: Ruslan Dautov, hxr1
IOSurfaceAccelerator
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to leak sensitive kernel state
Description: An information leakage was addressed with additional
validation.
CVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),
Franco Belman at Blackwing Intelligence
Kernel
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-28968: genter0, Svetoslav Stolarov & Aisa Fox, Josh Maine of
Calif.io, Dun
Kernel
Available for: Apple TV 4K 2nd generation and later
Impact: A local user may be able to cause unexpected system termination
or read kernel memory
Description: A race condition was addressed with additional validation.
CVE-2026-65415: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: Apple TV 4K 2nd generation and later
Impact: A remote attacker may be able to cause unexpected system
termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha
Kernel
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2026-65349: an anonymous researcher
Kernel
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: A double free issue was addressed with improved memory
management.
CVE-2026-84561: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Bhaswanth Chigurupati
Kernel
Available for: Apple TV 4K 2nd generation and later
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-84630: Tristan Madani (@TristanInSec) from Talence Security
CVE-2026-
Severity
No CVSS data available.
Assigner
References
7 references
Relationships
reference
GCVE-1988-2026-0396 (this record)
- related CVE-2026-28935
- related CVE-2026-28966
- related CVE-2026-28968
- related CVE-2026-28969
- related CVE-2026-43664
- related CVE-2026-43686
- related CVE-2026-43687
- related CVE-2026-43695
- related CVE-2026-43737
- related CVE-2026-43785
- related CVE-2026-43794
- related CVE-2026-64715
- related CVE-2026-64736
- related CVE-2026-64753
- related CVE-2026-64760
- related CVE-2026-64778
- related CVE-2026-64787
- related CVE-2026-65330
- related CVE-2026-65339
- related CVE-2026-65341
- related CVE-2026-65343
- related CVE-2026-65344
- related CVE-2026-65346
- related CVE-2026-65347
- related CVE-2026-65349
- related CVE-2026-65358
- related CVE-2026-65359
- related CVE-2026-65360
- related CVE-2026-65377
- related CVE-2026-65390
- related CVE-2026-65391
- related CVE-2026-65395
- related CVE-2026-65398
- related CVE-2026-65402
- related CVE-2026-65405
- related CVE-2026-65406
- related CVE-2026-65407
- related CVE-2026-65409
- related CVE-2026-65410
- related CVE-2026-65414
- related CVE-2026-65415
- related CVE-2026-84487
- related CVE-2026-84491
- related CVE-2026-84492
- related CVE-2026-84497
- related CVE-2026-84507
- related CVE-2026-84511
- related CVE-2026-84513
- related CVE-2026-84523
- related CVE-2026-84524
- related CVE-2026-84526
- related CVE-2026-84527
- related CVE-2026-84530
- related CVE-2026-84532
- related CVE-2026-84533
- related CVE-2026-84546
- related CVE-2026-84560
- related CVE-2026-84561
- related CVE-2026-84564
- related CVE-2026-84571
- related CVE-2026-84575
- related CVE-2026-84583
- related CVE-2026-84596
- related CVE-2026-84597
- related CVE-2026-84600
- related CVE-2026-84602
- related CVE-2026-84607
- related CVE-2026-84609
- related CVE-2026-84611
- related CVE-2026-84612
- related CVE-2026-84615
- related CVE-2026-84616
- related CVE-2026-84617
- related CVE-2026-84620
- related CVE-2026-84622
- related CVE-2026-84626
- related CVE-2026-84628
- related CVE-2026-84629
- related CVE-2026-84630
- related CVE-2026-84632
- related CVE-2026-84635
- related CVE-2026-84636
- related CVE-2026-86881
- related CVE-2026-86882
- related CVE-2026-86884
- related CVE-2026-86888
- related CVE-2026-86893
- related CVE-2026-86895
- related CVE-2026-86903
{
"containers": {
"cna": {
"affected": [
{
"product": "tvOS 27",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-6 tvOS 27\n\ntvOS 27 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149036.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAccessibility\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of\nTotally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,\nAsaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)\n\nAPFS\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nApp Store\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86888: Zhongcheng Li (CK01)\n\nAppleAVD\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAudio\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik\nTsytsarkin\n\nAuthKit\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nAVEVideoEncoder\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved checks.\nCVE-2026-65410: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nAVEVideoEncoder\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-84616: Peter Malone\n\nAVEVideoEncoder\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A sandboxed app may be able to execute arbitrary code with\nkernel privileges\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84607: Ruslan Dautov\n\nBackgroundAssets\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to access sensitive user data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\nBluetooth\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A remote attacker may be able to cause unexpected app\ntermination or arbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65414\n\nBluetooth\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may gain unauthorized access to Bluetooth\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84560: an anonymous researcher\n\nCloudKit\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: An information disclosure issue was addressed with improved\nstate management.\nCVE-2026-86895: Stanislav Jelezoglo\n\nCloudKit\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to read device name\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86893: Heiner Gerdes\n\nCoreMedia\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65344: Siyeong kim\n\nCoreMotion\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to access motion data from headphones without\nuser consent\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-43737: Stuart Wallace\n\nCoreText\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84596: ret2happy, Meta Product Security\n\nCoreUI\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\nCoreUI\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted image may lead to unexpected\napp termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-84571: stratan (@5tratan), Peter Malone\n\nCoreUI\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted asset catalog may lead to\nunexpected process termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84511: Rahul Raj, stratan (@5tratan)\n\nDeviceCheck\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to read persistent device identifiers\nDescription: An authorization issue was addressed with improved access\ncontrol.\nCVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill\n(@jjtech@infosec.exchange)\n\nFile Bookmark\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to modify a file it only had permission to\nread\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya\nKumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)\n\nFontParser\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted font file may lead to\nunexpected app termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84524: an anonymous researcher\n\nFontParser\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read issue was addressed with improved\ninput validation.\nCVE-2026-84597: Nik Tsytsarkin\n\nFoundation\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and\nAnthropic Research\n\nGraphics\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),\nJiyong Yang\n\nHeimdal\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An attacker in a privileged network position may be able to\nmodify network traffic\nDescription: A cryptographic issue was addressed with improved integrity\nchecks.\nCVE-2026-84533: Vishal Patidar, Roman Zabicki\n\nImageIO\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted image may result in disclosure\nof process memory\nDescription: An uninitialized memory issue was addressed with improved\nmemory initialization.\nCVE-2026-84564: Justin O\u0027Leary\n\nImageIO\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nImageIO\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: Processing a maliciously crafted image may result in memory\ncorruption\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan\n\nIOKit\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, \uc774\uc7ac\uc601\n\nIOMobileFrameBuffer\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,\ndbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nIOSurfaceAccelerator\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),\nFranco Belman at Blackwing Intelligence\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-28968: genter0, Svetoslav Stolarov \u0026 Aisa Fox, Josh Maine of\nCalif.io, Dun\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A race condition was addressed with additional validation.\nCVE-2026-65415: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation.\nCVE-2026-65349: an anonymous researcher\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A double free issue was addressed with improved memory\nmanagement.\nCVE-2026-84561: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Bhaswanth Chigurupati\n\nKernel\nAvailable for: Apple TV 4K 2nd generation and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-84630: Tristan Madani (@TristanInSec) from Talence Security\nCVE-2026-"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:30Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/58"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/58"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/149036"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/58"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-09-14-2026-6 tvOS 27",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-28935",
"type": "related"
},
{
"destId": "CVE-2026-28966",
"type": "related"
},
{
"destId": "CVE-2026-28968",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-43664",
"type": "related"
},
{
"destId": "CVE-2026-43686",
"type": "related"
},
{
"destId": "CVE-2026-43687",
"type": "related"
},
{
"destId": "CVE-2026-43695",
"type": "related"
},
{
"destId": "CVE-2026-43737",
"type": "related"
},
{
"destId": "CVE-2026-43785",
"type": "related"
},
{
"destId": "CVE-2026-43794",
"type": "related"
},
{
"destId": "CVE-2026-64715",
"type": "related"
},
{
"destId": "CVE-2026-64736",
"type": "related"
},
{
"destId": "CVE-2026-64753",
"type": "related"
},
{
"destId": "CVE-2026-64760",
"type": "related"
},
{
"destId": "CVE-2026-64778",
"type": "related"
},
{
"destId": "CVE-2026-64787",
"type": "related"
},
{
"destId": "CVE-2026-65330",
"type": "related"
},
{
"destId": "CVE-2026-65339",
"type": "related"
},
{
"destId": "CVE-2026-65341",
"type": "related"
},
{
"destId": "CVE-2026-65343",
"type": "related"
},
{
"destId": "CVE-2026-65344",
"type": "related"
},
{
"destId": "CVE-2026-65346",
"type": "related"
},
{
"destId": "CVE-2026-65347",
"type": "related"
},
{
"destId": "CVE-2026-65349",
"type": "related"
},
{
"destId": "CVE-2026-65358",
"type": "related"
},
{
"destId": "CVE-2026-65359",
"type": "related"
},
{
"destId": "CVE-2026-65360",
"type": "related"
},
{
"destId": "CVE-2026-65377",
"type": "related"
},
{
"destId": "CVE-2026-65390",
"type": "related"
},
{
"destId": "CVE-2026-65391",
"type": "related"
},
{
"destId": "CVE-2026-65395",
"type": "related"
},
{
"destId": "CVE-2026-65398",
"type": "related"
},
{
"destId": "CVE-2026-65402",
"type": "related"
},
{
"destId": "CVE-2026-65405",
"type": "related"
},
{
"destId": "CVE-2026-65406",
"type": "related"
},
{
"destId": "CVE-2026-65407",
"type": "related"
},
{
"destId": "CVE-2026-65409",
"type": "related"
},
{
"destId": "CVE-2026-65410",
"type": "related"
},
{
"destId": "CVE-2026-65414",
"type": "related"
},
{
"destId": "CVE-2026-65415",
"type": "related"
},
{
"destId": "CVE-2026-84487",
"type": "related"
},
{
"destId": "CVE-2026-84491",
"type": "related"
},
{
"destId": "CVE-2026-84492",
"type": "related"
},
{
"destId": "CVE-2026-84497",
"type": "related"
},
{
"destId": "CVE-2026-84507",
"type": "related"
},
{
"destId": "CVE-2026-84511",
"type": "related"
},
{
"destId": "CVE-2026-84513",
"type": "related"
},
{
"destId": "CVE-2026-84523",
"type": "related"
},
{
"destId": "CVE-2026-84524",
"type": "related"
},
{
"destId": "CVE-2026-84526",
"type": "related"
},
{
"destId": "CVE-2026-84527",
"type": "related"
},
{
"destId": "CVE-2026-84530",
"type": "related"
},
{
"destId": "CVE-2026-84532",
"type": "related"
},
{
"destId": "CVE-2026-84533",
"type": "related"
},
{
"destId": "CVE-2026-84546",
"type": "related"
},
{
"destId": "CVE-2026-84560",
"type": "related"
},
{
"destId": "CVE-2026-84561",
"type": "related"
},
{
"destId": "CVE-2026-84564",
"type": "related"
},
{
"destId": "CVE-2026-84571",
"type": "related"
},
{
"destId": "CVE-2026-84575",
"type": "related"
},
{
"destId": "CVE-2026-84583",
"type": "related"
},
{
"destId": "CVE-2026-84596",
"type": "related"
},
{
"destId": "CVE-2026-84597",
"type": "related"
},
{
"destId": "CVE-2026-84600",
"type": "related"
},
{
"destId": "CVE-2026-84602",
"type": "related"
},
{
"destId": "CVE-2026-84607",
"type": "related"
},
{
"destId": "CVE-2026-84609",
"type": "related"
},
{
"destId": "CVE-2026-84611",
"type": "related"
},
{
"destId": "CVE-2026-84612",
"type": "related"
},
{
"destId": "CVE-2026-84615",
"type": "related"
},
{
"destId": "CVE-2026-84616",
"type": "related"
},
{
"destId": "CVE-2026-84617",
"type": "related"
},
{
"destId": "CVE-2026-84620",
"type": "related"
},
{
"destId": "CVE-2026-84622",
"type": "related"
},
{
"destId": "CVE-2026-84626",
"type": "related"
},
{
"destId": "CVE-2026-84628",
"type": "related"
},
{
"destId": "CVE-2026-84629",
"type": "related"
},
{
"destId": "CVE-2026-84630",
"type": "related"
},
{
"destId": "CVE-2026-84632",
"type": "related"
},
{
"destId": "CVE-2026-84635",
"type": "related"
},
{
"destId": "CVE-2026-84636",
"type": "related"
},
{
"destId": "CVE-2026-86881",
"type": "related"
},
{
"destId": "CVE-2026-86882",
"type": "related"
},
{
"destId": "CVE-2026-86884",
"type": "related"
},
{
"destId": "CVE-2026-86888",
"type": "related"
},
{
"destId": "CVE-2026-86893",
"type": "related"
},
{
"destId": "CVE-2026-86895",
"type": "related"
},
{
"destId": "CVE-2026-86903",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0396",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/58",
"automated": true,
"contentSha256": "17dd0ec9f57afe1ffc10461f3711f60920deb25f184989429dfef2ad399bdd83",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/58",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-14T22:08:11Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0396"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:30Z",
"dateUpdated": "2026-10-02T04:57:30Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0396"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0397
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
APPLE-SA-09-14-2026-7 watchOS 27
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-7 watchOS 27
watchOS 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149037.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted image may lead to unexpected
process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86882: Peter Malone
Accessibility
Available for: Apple Watch Series 9 and later
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of
Totally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,
Asaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)
APFS
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher
App Store
Available for: Apple Watch Series 9 and later
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86888: Zhongcheng Li (CK01)
Apple Account
Available for: Apple Watch Series 9 and later
Impact: A malicious application may be able to leak sensitive user
information
Description: An information disclosure issue was addressed with improved
state management.
CVE-2026-84586: Prashan Samarathunge, Zhongcheng Li (CK01)
AppleAVD
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
Audio
Available for: Apple Watch Series 9 and later
Impact: An app may be able to leak sensitive user information
Description: A logic issue was addressed with improved checks.
CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik
Tsytsarkin
AuthKit
Available for: Apple Watch Series 9 and later
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84583: Zhongcheng Li from IES Red Team
AVEVideoEncoder
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved checks.
CVE-2026-65410: Calif.io in collaboration with Claude and Anthropic
Research
AVEVideoEncoder
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-84616: Peter Malone
AVEVideoEncoder
Available for: Apple Watch Series 9 and later
Impact: A sandboxed app may be able to execute arbitrary code with
kernel privileges
Description: A race condition was addressed with improved state
management.
CVE-2026-84607: Ruslan Dautov
Bluetooth
Available for: Apple Watch Series 9 and later
Impact: A remote attacker may be able to cause unexpected app
termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65414
Bluetooth
Available for: Apple Watch Series 9 and later
Impact: An app may gain unauthorized access to Bluetooth
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84560: an anonymous researcher
CloudKit
Available for: Apple Watch Series 9 and later
Impact: A local app may be able to read a persistent account identifier
Description: An information disclosure issue was addressed with improved
state management.
CVE-2026-86895: Stanislav Jelezoglo
CloudKit
Available for: Apple Watch Series 9 and later
Impact: An app may be able to read device name
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86893: Heiner Gerdes
copyfile
Available for: Apple Watch Series 9 and later
Impact: An archive may be able to bypass Gatekeeper
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,
an anonymous researcher
Core Bluetooth
Available for: Apple Watch Series 9 and later
Impact: An app may be able to access Bluetooth device information
Description: An authorization issue was addressed with improved state
management.
CVE-2026-86891: Dawuge of Shuffle Team
CoreMedia
Available for: Apple Watch Series 9 and later
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86876: Chris Bailey - Short Circuit
CoreMotion
Available for: Apple Watch Series 9 and later
Impact: An app may be able to access motion data from headphones without
user consent
Description: An authorization issue was addressed with improved
validation.
CVE-2026-43737: Stuart Wallace
CoreText
Available for: Apple Watch Series 9 and later
Impact: Processing web content may lead to a denial-of-service
Description: A null pointer dereference was addressed with improved
input validation.
CVE-2026-65412: Pavan Nallamothu
CoreText
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84596: ret2happy, Meta Product Security
CoreUI
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)
CoreUI
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted image may lead to unexpected
app termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-84571: stratan (@5tratan), Peter Malone
CoreUI
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted asset catalog may lead to
unexpected process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84511: Rahul Raj, stratan (@5tratan)
DeviceCheck
Available for: Apple Watch Series 9 and later
Impact: An app may be able to read persistent device identifiers
Description: An authorization issue was addressed with improved access
control.
CVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill
(@jjtech@infosec.exchange)
FontParser
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted font file may lead to
unexpected app termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84524: an anonymous researcher
FontParser
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read issue was addressed with improved
input validation.
CVE-2026-84597: Nik Tsytsarkin
Foundation
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause a denial of service
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and
Anthropic Research
Graphics
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),
Jiyong Yang
Heimdal
Available for: Apple Watch Series 9 and later
Impact: An attacker in a privileged network position may be able to
modify network traffic
Description: A cryptographic issue was addressed with improved integrity
checks.
CVE-2026-84533: Vishal Patidar, Roman Zabicki
ImageIO
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted image may result in disclosure
of process memory
Description: An uninitialized memory issue was addressed with improved
memory initialization.
CVE-2026-84564: Justin O'Leary
ImageIO
Available for: Apple Watch Series 9 and later
Impact: Processing an image may lead to a denial-of-service
Description: The issue was addressed with improved checks.
CVE-2026-65347: Geonha Lee (@leegn4a)
ImageIO
Available for: Apple Watch Series 9 and later
Impact: Processing an image may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-65346: Meta Red Team X - Nik Tsytsarkin
IOGPUFamily
Available for: Apple Watch Series 9 and later
Impact: Processing maliciously crafted web content may lead to memory
corruption
Description: The issue was addressed with improved memory handling.
CVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and
3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi
IOKit
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, 이재영
IOMobileFrameBuffer
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,
dbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin
CVE-2026-64736: Ruslan Dautov, hxr1
IOSurfaceAccelerator
Available for: Apple Watch Series 9 and later
Impact: An app may be able to leak sensitive kernel state
Description: An information leakage was addressed with additional
validation.
CVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),
Franco Belman at Blackwing Intelligence
Kernel
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-28968: genter0, Svetoslav Stolarov & Aisa Fox, Josh Maine of
Calif.io, Dun
Kernel
Available for: Apple Watch Series 9 and later
Impact: A local user may be able to cause unexpected system termination
or read kernel memory
Description: A race condition was addressed with additional validation.
CVE-2026-65415: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)
Kernel
Available for: Apple Watch Series 9 and later
Impact: A remote attacker may be able to cause unexpected system
termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha
Kernel
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2026-65349: an anonymous researcher
Kernel
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: A double free issue was addressed with improved memory
management.
CVE-2026-84561: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)
of STAR Labs SG Pte. Ltd., Bhaswanth Chi
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | watchOS 27 |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0397 (this record)
- related CVE-2026-28935
- related CVE-2026-28968
- related CVE-2026-28969
- related CVE-2026-43664
- related CVE-2026-43686
- related CVE-2026-43687
- related CVE-2026-43695
- related CVE-2026-43737
- related CVE-2026-43794
- related CVE-2026-64715
- related CVE-2026-64736
- related CVE-2026-64753
- related CVE-2026-64760
- related CVE-2026-64778
- related CVE-2026-64787
- related CVE-2026-64788
- related CVE-2026-65330
- related CVE-2026-65339
- related CVE-2026-65341
- related CVE-2026-65343
- related CVE-2026-65346
- related CVE-2026-65347
- related CVE-2026-65349
- related CVE-2026-65358
- related CVE-2026-65359
- related CVE-2026-65360
- related CVE-2026-65377
- related CVE-2026-65390
- related CVE-2026-65391
- related CVE-2026-65398
- related CVE-2026-65399
- related CVE-2026-65402
- related CVE-2026-65403
- related CVE-2026-65405
- related CVE-2026-65407
- related CVE-2026-65409
- related CVE-2026-65410
- related CVE-2026-65412
- related CVE-2026-65414
- related CVE-2026-65415
- related CVE-2026-84487
- related CVE-2026-84491
- related CVE-2026-84492
- related CVE-2026-84507
- related CVE-2026-84511
- related CVE-2026-84513
- related CVE-2026-84523
- related CVE-2026-84524
- related CVE-2026-84526
- related CVE-2026-84527
- related CVE-2026-84530
- related CVE-2026-84533
- related CVE-2026-84546
- related CVE-2026-84551
- related CVE-2026-84560
- related CVE-2026-84561
- related CVE-2026-84564
- related CVE-2026-84571
- related CVE-2026-84575
- related CVE-2026-84583
- related CVE-2026-84586
- related CVE-2026-84596
- related CVE-2026-84597
- related CVE-2026-84600
- related CVE-2026-84602
- related CVE-2026-84603
- related CVE-2026-84607
- related CVE-2026-84609
- related CVE-2026-84611
- related CVE-2026-84612
- related CVE-2026-84616
- related CVE-2026-84620
- related CVE-2026-84622
- related CVE-2026-84625
- related CVE-2026-84626
- related CVE-2026-84628
- related CVE-2026-84629
- related CVE-2026-84630
- related CVE-2026-84632
- related CVE-2026-84635
- related CVE-2026-84636
- related CVE-2026-86870
- related CVE-2026-86876
- related CVE-2026-86881
- related CVE-2026-86882
- related CVE-2026-86884
- related CVE-2026-86886
- related CVE-2026-86888
- related CVE-2026-86891
- related CVE-2026-86893
- related CVE-2026-86895
- related CVE-2026-86903
- related CVE-2026-86904
{
"containers": {
"cna": {
"affected": [
{
"product": "watchOS 27",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-7 watchOS 27\n\nwatchOS 27 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149037.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAccessibility\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of\nTotally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,\nAsaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)\n\nAPFS\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nApp Store\nAvailable for: Apple Watch Series 9 and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86888: Zhongcheng Li (CK01)\n\nApple Account\nAvailable for: Apple Watch Series 9 and later\nImpact: A malicious application may be able to leak sensitive user\ninformation\nDescription: An information disclosure issue was addressed with improved\nstate management.\nCVE-2026-84586: Prashan Samarathunge, Zhongcheng Li (CK01)\n\nAppleAVD\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAudio\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik\nTsytsarkin\n\nAuthKit\nAvailable for: Apple Watch Series 9 and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nAVEVideoEncoder\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved checks.\nCVE-2026-65410: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nAVEVideoEncoder\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-84616: Peter Malone\n\nAVEVideoEncoder\nAvailable for: Apple Watch Series 9 and later\nImpact: A sandboxed app may be able to execute arbitrary code with\nkernel privileges\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84607: Ruslan Dautov\n\nBluetooth\nAvailable for: Apple Watch Series 9 and later\nImpact: A remote attacker may be able to cause unexpected app\ntermination or arbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65414\n\nBluetooth\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may gain unauthorized access to Bluetooth\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84560: an anonymous researcher\n\nCloudKit\nAvailable for: Apple Watch Series 9 and later\nImpact: A local app may be able to read a persistent account identifier\nDescription: An information disclosure issue was addressed with improved\nstate management.\nCVE-2026-86895: Stanislav Jelezoglo\n\nCloudKit\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to read device name\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86893: Heiner Gerdes\n\ncopyfile\nAvailable for: Apple Watch Series 9 and later\nImpact: An archive may be able to bypass Gatekeeper\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,\nan anonymous researcher\n\nCore Bluetooth\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to access Bluetooth device information\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-86891: Dawuge of Shuffle Team\n\nCoreMedia\nAvailable for: Apple Watch Series 9 and later\nImpact: A sandboxed process may be able to circumvent sandbox\nrestrictions\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86876: Chris Bailey - Short Circuit\n\nCoreMotion\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to access motion data from headphones without\nuser consent\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-43737: Stuart Wallace\n\nCoreText\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing web content may lead to a denial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-65412: Pavan Nallamothu\n\nCoreText\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84596: ret2happy, Meta Product Security\n\nCoreUI\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\nCoreUI\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted image may lead to unexpected\napp termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-84571: stratan (@5tratan), Peter Malone\n\nCoreUI\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted asset catalog may lead to\nunexpected process termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84511: Rahul Raj, stratan (@5tratan)\n\nDeviceCheck\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to read persistent device identifiers\nDescription: An authorization issue was addressed with improved access\ncontrol.\nCVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill\n(@jjtech@infosec.exchange)\n\nFontParser\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted font file may lead to\nunexpected app termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84524: an anonymous researcher\n\nFontParser\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read issue was addressed with improved\ninput validation.\nCVE-2026-84597: Nik Tsytsarkin\n\nFoundation\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and\nAnthropic Research\n\nGraphics\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),\nJiyong Yang\n\nHeimdal\nAvailable for: Apple Watch Series 9 and later\nImpact: An attacker in a privileged network position may be able to\nmodify network traffic\nDescription: A cryptographic issue was addressed with improved integrity\nchecks.\nCVE-2026-84533: Vishal Patidar, Roman Zabicki\n\nImageIO\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing a maliciously crafted image may result in disclosure\nof process memory\nDescription: An uninitialized memory issue was addressed with improved\nmemory initialization.\nCVE-2026-84564: Justin O\u0027Leary\n\nImageIO\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nIOGPUFamily\nAvailable for: Apple Watch Series 9 and later\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and\n3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and \u4e91\u6563\u82b1\u6298, Arjanit Isufi\n\nIOKit\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, \uc774\uc7ac\uc601\n\nIOMobileFrameBuffer\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,\ndbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nIOSurfaceAccelerator\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),\nFranco Belman at Blackwing Intelligence\n\nKernel\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-28968: genter0, Svetoslav Stolarov \u0026 Aisa Fox, Josh Maine of\nCalif.io, Dun\n\nKernel\nAvailable for: Apple Watch Series 9 and later\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A race condition was addressed with additional validation.\nCVE-2026-65415: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple Watch Series 9 and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\nKernel\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation.\nCVE-2026-65349: an anonymous researcher\n\nKernel\nAvailable for: Apple Watch Series 9 and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: A double free issue was addressed with improved memory\nmanagement.\nCVE-2026-84561: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Bhaswanth Chi"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:31Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/59"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/59"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/149037"
},
{
"url": "https://support.apple.com/kb/HT204641"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/59"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-09-14-2026-7 watchOS 27",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-28935",
"type": "related"
},
{
"destId": "CVE-2026-28968",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-43664",
"type": "related"
},
{
"destId": "CVE-2026-43686",
"type": "related"
},
{
"destId": "CVE-2026-43687",
"type": "related"
},
{
"destId": "CVE-2026-43695",
"type": "related"
},
{
"destId": "CVE-2026-43737",
"type": "related"
},
{
"destId": "CVE-2026-43794",
"type": "related"
},
{
"destId": "CVE-2026-64715",
"type": "related"
},
{
"destId": "CVE-2026-64736",
"type": "related"
},
{
"destId": "CVE-2026-64753",
"type": "related"
},
{
"destId": "CVE-2026-64760",
"type": "related"
},
{
"destId": "CVE-2026-64778",
"type": "related"
},
{
"destId": "CVE-2026-64787",
"type": "related"
},
{
"destId": "CVE-2026-64788",
"type": "related"
},
{
"destId": "CVE-2026-65330",
"type": "related"
},
{
"destId": "CVE-2026-65339",
"type": "related"
},
{
"destId": "CVE-2026-65341",
"type": "related"
},
{
"destId": "CVE-2026-65343",
"type": "related"
},
{
"destId": "CVE-2026-65346",
"type": "related"
},
{
"destId": "CVE-2026-65347",
"type": "related"
},
{
"destId": "CVE-2026-65349",
"type": "related"
},
{
"destId": "CVE-2026-65358",
"type": "related"
},
{
"destId": "CVE-2026-65359",
"type": "related"
},
{
"destId": "CVE-2026-65360",
"type": "related"
},
{
"destId": "CVE-2026-65377",
"type": "related"
},
{
"destId": "CVE-2026-65390",
"type": "related"
},
{
"destId": "CVE-2026-65391",
"type": "related"
},
{
"destId": "CVE-2026-65398",
"type": "related"
},
{
"destId": "CVE-2026-65399",
"type": "related"
},
{
"destId": "CVE-2026-65402",
"type": "related"
},
{
"destId": "CVE-2026-65403",
"type": "related"
},
{
"destId": "CVE-2026-65405",
"type": "related"
},
{
"destId": "CVE-2026-65407",
"type": "related"
},
{
"destId": "CVE-2026-65409",
"type": "related"
},
{
"destId": "CVE-2026-65410",
"type": "related"
},
{
"destId": "CVE-2026-65412",
"type": "related"
},
{
"destId": "CVE-2026-65414",
"type": "related"
},
{
"destId": "CVE-2026-65415",
"type": "related"
},
{
"destId": "CVE-2026-84487",
"type": "related"
},
{
"destId": "CVE-2026-84491",
"type": "related"
},
{
"destId": "CVE-2026-84492",
"type": "related"
},
{
"destId": "CVE-2026-84507",
"type": "related"
},
{
"destId": "CVE-2026-84511",
"type": "related"
},
{
"destId": "CVE-2026-84513",
"type": "related"
},
{
"destId": "CVE-2026-84523",
"type": "related"
},
{
"destId": "CVE-2026-84524",
"type": "related"
},
{
"destId": "CVE-2026-84526",
"type": "related"
},
{
"destId": "CVE-2026-84527",
"type": "related"
},
{
"destId": "CVE-2026-84530",
"type": "related"
},
{
"destId": "CVE-2026-84533",
"type": "related"
},
{
"destId": "CVE-2026-84546",
"type": "related"
},
{
"destId": "CVE-2026-84551",
"type": "related"
},
{
"destId": "CVE-2026-84560",
"type": "related"
},
{
"destId": "CVE-2026-84561",
"type": "related"
},
{
"destId": "CVE-2026-84564",
"type": "related"
},
{
"destId": "CVE-2026-84571",
"type": "related"
},
{
"destId": "CVE-2026-84575",
"type": "related"
},
{
"destId": "CVE-2026-84583",
"type": "related"
},
{
"destId": "CVE-2026-84586",
"type": "related"
},
{
"destId": "CVE-2026-84596",
"type": "related"
},
{
"destId": "CVE-2026-84597",
"type": "related"
},
{
"destId": "CVE-2026-84600",
"type": "related"
},
{
"destId": "CVE-2026-84602",
"type": "related"
},
{
"destId": "CVE-2026-84603",
"type": "related"
},
{
"destId": "CVE-2026-84607",
"type": "related"
},
{
"destId": "CVE-2026-84609",
"type": "related"
},
{
"destId": "CVE-2026-84611",
"type": "related"
},
{
"destId": "CVE-2026-84612",
"type": "related"
},
{
"destId": "CVE-2026-84616",
"type": "related"
},
{
"destId": "CVE-2026-84620",
"type": "related"
},
{
"destId": "CVE-2026-84622",
"type": "related"
},
{
"destId": "CVE-2026-84625",
"type": "related"
},
{
"destId": "CVE-2026-84626",
"type": "related"
},
{
"destId": "CVE-2026-84628",
"type": "related"
},
{
"destId": "CVE-2026-84629",
"type": "related"
},
{
"destId": "CVE-2026-84630",
"type": "related"
},
{
"destId": "CVE-2026-84632",
"type": "related"
},
{
"destId": "CVE-2026-84635",
"type": "related"
},
{
"destId": "CVE-2026-84636",
"type": "related"
},
{
"destId": "CVE-2026-86870",
"type": "related"
},
{
"destId": "CVE-2026-86876",
"type": "related"
},
{
"destId": "CVE-2026-86881",
"type": "related"
},
{
"destId": "CVE-2026-86882",
"type": "related"
},
{
"destId": "CVE-2026-86884",
"type": "related"
},
{
"destId": "CVE-2026-86886",
"type": "related"
},
{
"destId": "CVE-2026-86888",
"type": "related"
},
{
"destId": "CVE-2026-86891",
"type": "related"
},
{
"destId": "CVE-2026-86893",
"type": "related"
},
{
"destId": "CVE-2026-86895",
"type": "related"
},
{
"destId": "CVE-2026-86903",
"type": "related"
},
{
"destId": "CVE-2026-86904",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0397",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/59",
"automated": true,
"contentSha256": "f0f79b792a59ca091ec420d4f64d4e732790c665263927591be75cdc976fe162",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/59",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-14T22:09:02Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0397"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:31Z",
"dateUpdated": "2026-10-02T04:57:31Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0397"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0398
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
APPLE-SA-09-14-2026-8 visionOS 27
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-8 visionOS 27
visionOS 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149038.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may lead to unexpected
process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86882: Peter Malone
APFS
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher
App Store
Available for: Apple Vision Pro (all models)
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86888: Zhongcheng Li (CK01)
Apple Account
Available for: Apple Vision Pro (all models)
Impact: An app may be able to use the Sign In With Apple authentication
flow to access the user's Apple Account
Description: An authentication issue was addressed with improved state
management.
CVE-2026-20683: Dem0ns (@天府简易信工作室), Abdelhak Kherroubi, Jasminder Pal
Singh, Lehan Dilusha Jayasingha (Sri Lanka)
AppleAVD
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
Audio
Available for: Apple Vision Pro (all models)
Impact: An app may be able to leak sensitive user information
Description: A logic issue was addressed with improved checks.
CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik
Tsytsarkin
Authentication Services
Available for: Apple Vision Pro (all models)
Impact: An app may be able to delete credentials stored in Keychain
Description: This issue was addressed by removing the vulnerable code.
CVE-2026-86905: Ilya Andr (andrd3v)
AuthKit
Available for: Apple Vision Pro (all models)
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84583: Zhongcheng Li from IES Red Team
AVEVideoEncoder
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved checks.
CVE-2026-65410: Calif.io in collaboration with Claude and Anthropic
Research
AVEVideoEncoder
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-84616: Peter Malone
AVEVideoEncoder
Available for: Apple Vision Pro (all models)
Impact: A sandboxed app may be able to execute arbitrary code with
kernel privileges
Description: A race condition was addressed with improved state
management.
CVE-2026-84607: Ruslan Dautov
BackgroundAssets
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved validation.
CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security
Bluetooth
Available for: Apple Vision Pro (all models)
Impact: A remote attacker may be able to cause unexpected app
termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65414
Bluetooth
Available for: Apple Vision Pro (all models)
Impact: An app may gain unauthorized access to Bluetooth
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84560: an anonymous researcher
CloudKit
Available for: Apple Vision Pro (all models)
Impact: A local app may be able to read a persistent account identifier
Description: An information disclosure issue was addressed with improved
state management.
CVE-2026-86895: Stanislav Jelezoglo
CloudKit
Available for: Apple Vision Pro (all models)
Impact: An app may be able to read device name
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86893: Heiner Gerdes
copyfile
Available for: Apple Vision Pro (all models)
Impact: An archive may be able to bypass Gatekeeper
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,
an anonymous researcher
CoreMedia
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A memory corruption issue was addressed by removing the
vulnerable code.
CVE-2026-64752: Nik Tsytsarkin
CoreMedia
Available for: Apple Vision Pro (all models)
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86876: Chris Bailey - Short Circuit
CoreMedia
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65344: Siyeong kim
CoreML
Available for: Apple Vision Pro (all models)
Impact: A sandboxed app may be able to access restricted files
Description: A permissions issue was addressed with improved path
validation.
CVE-2026-84624: AL Najafi, tamdao
CoreText
Available for: Apple Vision Pro (all models)
Impact: Processing web content may lead to a denial-of-service
Description: A null pointer dereference was addressed with improved
input validation.
CVE-2026-65412: Pavan Nallamothu
CoreText
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84596: ret2happy, Meta Product Security
CoreUI
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)
CoreUI
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may lead to unexpected
app termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-84571: stratan (@5tratan), Peter Malone
CoreUI
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted asset catalog may lead to
unexpected process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84511: Rahul Raj, stratan (@5tratan)
DeviceCheck
Available for: Apple Vision Pro (all models)
Impact: An app may be able to read persistent device identifiers
Description: An authorization issue was addressed with improved access
control.
CVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill
(@jjtech@infosec.exchange)
File Bookmark
Available for: Apple Vision Pro (all models)
Impact: An app may be able to modify a file it only had permission to
read
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya
Kumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)
file_cmds
Available for: Apple Vision Pro (all models)
Impact: Extracting a maliciously crafted archive may allow an attacker
to write arbitrary files
Description: A path handling issue was addressed with improved
validation.
CVE-2026-84534: Geoffrey Lovelace
FontParser
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted font file may lead to
unexpected app termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84524: an anonymous researcher
FontParser
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read issue was addressed with improved
input validation.
CVE-2026-84597: Nik Tsytsarkin
Foundation
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause a denial of service
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and
Anthropic Research
Graphics
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),
Jiyong Yang
iCloud
Available for: Apple Vision Pro (all models)
Impact: An app may be able to identify a user across reinstalls
Description: A privacy issue was addressed with improved handling of
identifiers.
CVE-2026-84606: Ilya Andr (andrd3v)
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may result in disclosure
of process memory
Description: An uninitialized memory issue was addressed with improved
memory initialization.
CVE-2026-84564: Justin O'Leary
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing an image may lead to a denial-of-service
Description: The issue was addressed with improved checks.
CVE-2026-65347: Geonha Lee (@leegn4a)
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing an image may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-65346: Meta Red Team X - Nik Tsytsarkin
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may result in memory
corruption
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan
IOGPUFamily
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may lead to memory
corruption
Description: The issue was addressed with improved memory handling.
CVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and
3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi
IOKit
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, 이재영
IOMobileFrameBuffer
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,
dbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin
CVE-2026-64736: Ruslan Dautov, hxr1
IOSurfaceAccelerator
Available for: Apple Vision Pro (all models)
Impact: An app may be able to leak sensitive kernel state
Description: An information leakage was addressed with additional
validation.
CVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),
Franco Belman at Blackwing Intelligence
Kernel
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-28968: genter0, Svetoslav Stolarov & Aisa Fox, Josh Maine of
Calif.io, Dun
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | visionOS 27 |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0398 (this record)
- related CVE-2026-20683
- related CVE-2026-28935
- related CVE-2026-28966
- related CVE-2026-28968
- related CVE-2026-28969
- related CVE-2026-43686
- related CVE-2026-43687
- related CVE-2026-43689
- related CVE-2026-43695
- related CVE-2026-43785
- related CVE-2026-43794
- related CVE-2026-43795
- related CVE-2026-64715
- related CVE-2026-64718
- related CVE-2026-64736
- related CVE-2026-64752
- related CVE-2026-64753
- related CVE-2026-64760
- related CVE-2026-64778
- related CVE-2026-64779
- related CVE-2026-64780
- related CVE-2026-64781
- related CVE-2026-64782
- related CVE-2026-64784
- related CVE-2026-64787
- related CVE-2026-64788
- related CVE-2026-65330
- related CVE-2026-65331
- related CVE-2026-65332
- related CVE-2026-65333
- related CVE-2026-65334
- related CVE-2026-65335
- related CVE-2026-65336
- related CVE-2026-65337
- related CVE-2026-65338
- related CVE-2026-65339
- related CVE-2026-65340
- related CVE-2026-65341
- related CVE-2026-65343
- related CVE-2026-65344
- related CVE-2026-65346
- related CVE-2026-65347
- related CVE-2026-65349
- related CVE-2026-65351
- related CVE-2026-65358
- related CVE-2026-65359
- related CVE-2026-65360
- related CVE-2026-65377
- related CVE-2026-65390
- related CVE-2026-65391
- related CVE-2026-65395
- related CVE-2026-65398
- related CVE-2026-65399
- related CVE-2026-65402
- related CVE-2026-65403
- related CVE-2026-65405
- related CVE-2026-65406
- related CVE-2026-65407
- related CVE-2026-65409
- related CVE-2026-65410
- related CVE-2026-65411
- related CVE-2026-65412
- related CVE-2026-65414
- related CVE-2026-65415
- related CVE-2026-84487
- related CVE-2026-84491
- related CVE-2026-84492
- related CVE-2026-84497
- related CVE-2026-84507
- related CVE-2026-84511
- related CVE-2026-84513
- related CVE-2026-84521
- related CVE-2026-84523
- related CVE-2026-84524
- related CVE-2026-84526
- related CVE-2026-84527
- related CVE-2026-84530
- related CVE-2026-84532
- related CVE-2026-84534
- related CVE-2026-84546
- related CVE-2026-84551
- related CVE-2026-84560
- related CVE-2026-84561
- related CVE-2026-84564
- related CVE-2026-84571
- related CVE-2026-84575
- related CVE-2026-84583
- related CVE-2026-84596
- related CVE-2026-84597
- related CVE-2026-84600
- related CVE-2026-84602
- related CVE-2026-84603
- related CVE-2026-84606
- related CVE-2026-84607
- related CVE-2026-84609
- related CVE-2026-84611
- related CVE-2026-84612
- related CVE-2026-84615
- related CVE-2026-84616
- related CVE-2026-84620
- related CVE-2026-84622
- related CVE-2026-84624
- related CVE-2026-84625
- related CVE-2026-84626
- related CVE-2026-84628
- related CVE-2026-84629
- related CVE-2026-84630
- related CVE-2026-84632
- related CVE-2026-84635
- related CVE-2026-84636
- related CVE-2026-86870
- related CVE-2026-86876
- related CVE-2026-86881
- related CVE-2026-86882
- related CVE-2026-86883
- related CVE-2026-86887
- related CVE-2026-86888
- related CVE-2026-86892
- related CVE-2026-86893
- related CVE-2026-86895
- related CVE-2026-86897
- related CVE-2026-86898
- related CVE-2026-86903
- related CVE-2026-86905
{
"containers": {
"cna": {
"affected": [
{
"product": "visionOS 27",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-8 visionOS 27\n\nvisionOS 27 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149038.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAPFS\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nApp Store\nAvailable for: Apple Vision Pro (all models)\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86888: Zhongcheng Li (CK01)\n\nApple Account\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to use the Sign In With Apple authentication\nflow to access the user\u0027s Apple Account\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-20683: Dem0ns (@\u5929\u5e9c\u7b80\u6613\u4fe1\u5de5\u4f5c\u5ba4), Abdelhak Kherroubi, Jasminder Pal\nSingh, Lehan Dilusha Jayasingha (Sri Lanka)\n\nAppleAVD\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik\nTsytsarkin\n\nAuthentication Services\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to delete credentials stored in Keychain\nDescription: This issue was addressed by removing the vulnerable code.\nCVE-2026-86905: Ilya Andr (andrd3v)\n\nAuthKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nAVEVideoEncoder\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved checks.\nCVE-2026-65410: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nAVEVideoEncoder\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-84616: Peter Malone\n\nAVEVideoEncoder\nAvailable for: Apple Vision Pro (all models)\nImpact: A sandboxed app may be able to execute arbitrary code with\nkernel privileges\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84607: Ruslan Dautov\n\nBackgroundAssets\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\nBluetooth\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause unexpected app\ntermination or arbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65414\n\nBluetooth\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may gain unauthorized access to Bluetooth\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84560: an anonymous researcher\n\nCloudKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A local app may be able to read a persistent account identifier\nDescription: An information disclosure issue was addressed with improved\nstate management.\nCVE-2026-86895: Stanislav Jelezoglo\n\nCloudKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to read device name\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86893: Heiner Gerdes\n\ncopyfile\nAvailable for: Apple Vision Pro (all models)\nImpact: An archive may be able to bypass Gatekeeper\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,\nan anonymous researcher\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: A memory corruption issue was addressed by removing the\nvulnerable code.\nCVE-2026-64752: Nik Tsytsarkin\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: A sandboxed process may be able to circumvent sandbox\nrestrictions\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86876: Chris Bailey - Short Circuit\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65344: Siyeong kim\n\nCoreML\nAvailable for: Apple Vision Pro (all models)\nImpact: A sandboxed app may be able to access restricted files\nDescription: A permissions issue was addressed with improved path\nvalidation.\nCVE-2026-84624: AL Najafi, tamdao\n\nCoreText\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing web content may lead to a denial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-65412: Pavan Nallamothu\n\nCoreText\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84596: ret2happy, Meta Product Security\n\nCoreUI\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\nCoreUI\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to unexpected\napp termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-84571: stratan (@5tratan), Peter Malone\n\nCoreUI\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted asset catalog may lead to\nunexpected process termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84511: Rahul Raj, stratan (@5tratan)\n\nDeviceCheck\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to read persistent device identifiers\nDescription: An authorization issue was addressed with improved access\ncontrol.\nCVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill\n(@jjtech@infosec.exchange)\n\nFile Bookmark\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to modify a file it only had permission to\nread\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya\nKumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)\n\nfile_cmds\nAvailable for: Apple Vision Pro (all models)\nImpact: Extracting a maliciously crafted archive may allow an attacker\nto write arbitrary files\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-84534: Geoffrey Lovelace\n\nFontParser\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted font file may lead to\nunexpected app termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84524: an anonymous researcher\n\nFontParser\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read issue was addressed with improved\ninput validation.\nCVE-2026-84597: Nik Tsytsarkin\n\nFoundation\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and\nAnthropic Research\n\nGraphics\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),\nJiyong Yang\n\niCloud\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to identify a user across reinstalls\nDescription: A privacy issue was addressed with improved handling of\nidentifiers.\nCVE-2026-84606: Ilya Andr (andrd3v)\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may result in disclosure\nof process memory\nDescription: An uninitialized memory issue was addressed with improved\nmemory initialization.\nCVE-2026-84564: Justin O\u0027Leary\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may result in memory\ncorruption\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan\n\nIOGPUFamily\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and\n3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and \u4e91\u6563\u82b1\u6298, Arjanit Isufi\n\nIOKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, \uc774\uc7ac\uc601\n\nIOMobileFrameBuffer\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,\ndbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nIOSurfaceAccelerator\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),\nFranco Belman at Blackwing Intelligence\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-28968: genter0, Svetoslav Stolarov \u0026 Aisa Fox, Josh Maine of\nCalif.io, Dun\n"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:32Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/60"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/60"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/149038"
},
{
"url": "https://support.apple.com/kb/HT214009"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/60"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-09-14-2026-8 visionOS 27",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-20683",
"type": "related"
},
{
"destId": "CVE-2026-28935",
"type": "related"
},
{
"destId": "CVE-2026-28966",
"type": "related"
},
{
"destId": "CVE-2026-28968",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-43686",
"type": "related"
},
{
"destId": "CVE-2026-43687",
"type": "related"
},
{
"destId": "CVE-2026-43689",
"type": "related"
},
{
"destId": "CVE-2026-43695",
"type": "related"
},
{
"destId": "CVE-2026-43785",
"type": "related"
},
{
"destId": "CVE-2026-43794",
"type": "related"
},
{
"destId": "CVE-2026-43795",
"type": "related"
},
{
"destId": "CVE-2026-64715",
"type": "related"
},
{
"destId": "CVE-2026-64718",
"type": "related"
},
{
"destId": "CVE-2026-64736",
"type": "related"
},
{
"destId": "CVE-2026-64752",
"type": "related"
},
{
"destId": "CVE-2026-64753",
"type": "related"
},
{
"destId": "CVE-2026-64760",
"type": "related"
},
{
"destId": "CVE-2026-64778",
"type": "related"
},
{
"destId": "CVE-2026-64779",
"type": "related"
},
{
"destId": "CVE-2026-64780",
"type": "related"
},
{
"destId": "CVE-2026-64781",
"type": "related"
},
{
"destId": "CVE-2026-64782",
"type": "related"
},
{
"destId": "CVE-2026-64784",
"type": "related"
},
{
"destId": "CVE-2026-64787",
"type": "related"
},
{
"destId": "CVE-2026-64788",
"type": "related"
},
{
"destId": "CVE-2026-65330",
"type": "related"
},
{
"destId": "CVE-2026-65331",
"type": "related"
},
{
"destId": "CVE-2026-65332",
"type": "related"
},
{
"destId": "CVE-2026-65333",
"type": "related"
},
{
"destId": "CVE-2026-65334",
"type": "related"
},
{
"destId": "CVE-2026-65335",
"type": "related"
},
{
"destId": "CVE-2026-65336",
"type": "related"
},
{
"destId": "CVE-2026-65337",
"type": "related"
},
{
"destId": "CVE-2026-65338",
"type": "related"
},
{
"destId": "CVE-2026-65339",
"type": "related"
},
{
"destId": "CVE-2026-65340",
"type": "related"
},
{
"destId": "CVE-2026-65341",
"type": "related"
},
{
"destId": "CVE-2026-65343",
"type": "related"
},
{
"destId": "CVE-2026-65344",
"type": "related"
},
{
"destId": "CVE-2026-65346",
"type": "related"
},
{
"destId": "CVE-2026-65347",
"type": "related"
},
{
"destId": "CVE-2026-65349",
"type": "related"
},
{
"destId": "CVE-2026-65351",
"type": "related"
},
{
"destId": "CVE-2026-65358",
"type": "related"
},
{
"destId": "CVE-2026-65359",
"type": "related"
},
{
"destId": "CVE-2026-65360",
"type": "related"
},
{
"destId": "CVE-2026-65377",
"type": "related"
},
{
"destId": "CVE-2026-65390",
"type": "related"
},
{
"destId": "CVE-2026-65391",
"type": "related"
},
{
"destId": "CVE-2026-65395",
"type": "related"
},
{
"destId": "CVE-2026-65398",
"type": "related"
},
{
"destId": "CVE-2026-65399",
"type": "related"
},
{
"destId": "CVE-2026-65402",
"type": "related"
},
{
"destId": "CVE-2026-65403",
"type": "related"
},
{
"destId": "CVE-2026-65405",
"type": "related"
},
{
"destId": "CVE-2026-65406",
"type": "related"
},
{
"destId": "CVE-2026-65407",
"type": "related"
},
{
"destId": "CVE-2026-65409",
"type": "related"
},
{
"destId": "CVE-2026-65410",
"type": "related"
},
{
"destId": "CVE-2026-65411",
"type": "related"
},
{
"destId": "CVE-2026-65412",
"type": "related"
},
{
"destId": "CVE-2026-65414",
"type": "related"
},
{
"destId": "CVE-2026-65415",
"type": "related"
},
{
"destId": "CVE-2026-84487",
"type": "related"
},
{
"destId": "CVE-2026-84491",
"type": "related"
},
{
"destId": "CVE-2026-84492",
"type": "related"
},
{
"destId": "CVE-2026-84497",
"type": "related"
},
{
"destId": "CVE-2026-84507",
"type": "related"
},
{
"destId": "CVE-2026-84511",
"type": "related"
},
{
"destId": "CVE-2026-84513",
"type": "related"
},
{
"destId": "CVE-2026-84521",
"type": "related"
},
{
"destId": "CVE-2026-84523",
"type": "related"
},
{
"destId": "CVE-2026-84524",
"type": "related"
},
{
"destId": "CVE-2026-84526",
"type": "related"
},
{
"destId": "CVE-2026-84527",
"type": "related"
},
{
"destId": "CVE-2026-84530",
"type": "related"
},
{
"destId": "CVE-2026-84532",
"type": "related"
},
{
"destId": "CVE-2026-84534",
"type": "related"
},
{
"destId": "CVE-2026-84546",
"type": "related"
},
{
"destId": "CVE-2026-84551",
"type": "related"
},
{
"destId": "CVE-2026-84560",
"type": "related"
},
{
"destId": "CVE-2026-84561",
"type": "related"
},
{
"destId": "CVE-2026-84564",
"type": "related"
},
{
"destId": "CVE-2026-84571",
"type": "related"
},
{
"destId": "CVE-2026-84575",
"type": "related"
},
{
"destId": "CVE-2026-84583",
"type": "related"
},
{
"destId": "CVE-2026-84596",
"type": "related"
},
{
"destId": "CVE-2026-84597",
"type": "related"
},
{
"destId": "CVE-2026-84600",
"type": "related"
},
{
"destId": "CVE-2026-84602",
"type": "related"
},
{
"destId": "CVE-2026-84603",
"type": "related"
},
{
"destId": "CVE-2026-84606",
"type": "related"
},
{
"destId": "CVE-2026-84607",
"type": "related"
},
{
"destId": "CVE-2026-84609",
"type": "related"
},
{
"destId": "CVE-2026-84611",
"type": "related"
},
{
"destId": "CVE-2026-84612",
"type": "related"
},
{
"destId": "CVE-2026-84615",
"type": "related"
},
{
"destId": "CVE-2026-84616",
"type": "related"
},
{
"destId": "CVE-2026-84620",
"type": "related"
},
{
"destId": "CVE-2026-84622",
"type": "related"
},
{
"destId": "CVE-2026-84624",
"type": "related"
},
{
"destId": "CVE-2026-84625",
"type": "related"
},
{
"destId": "CVE-2026-84626",
"type": "related"
},
{
"destId": "CVE-2026-84628",
"type": "related"
},
{
"destId": "CVE-2026-84629",
"type": "related"
},
{
"destId": "CVE-2026-84630",
"type": "related"
},
{
"destId": "CVE-2026-84632",
"type": "related"
},
{
"destId": "CVE-2026-84635",
"type": "related"
},
{
"destId": "CVE-2026-84636",
"type": "related"
},
{
"destId": "CVE-2026-86870",
"type": "related"
},
{
"destId": "CVE-2026-86876",
"type": "related"
},
{
"destId": "CVE-2026-86881",
"type": "related"
},
{
"destId": "CVE-2026-86882",
"type": "related"
},
{
"destId": "CVE-2026-86883",
"type": "related"
},
{
"destId": "CVE-2026-86887",
"type": "related"
},
{
"destId": "CVE-2026-86888",
"type": "related"
},
{
"destId": "CVE-2026-86892",
"type": "related"
},
{
"destId": "CVE-2026-86893",
"type": "related"
},
{
"destId": "CVE-2026-86895",
"type": "related"
},
{
"destId": "CVE-2026-86897",
"type": "related"
},
{
"destId": "CVE-2026-86898",
"type": "related"
},
{
"destId": "CVE-2026-86903",
"type": "related"
},
{
"destId": "CVE-2026-86905",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0398",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/60",
"automated": true,
"contentSha256": "d1a72a0a042e783ac09829d6e2610d4e6db9aa438ec5ede9027011353dc55579",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/60",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-14T22:09:24Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0398"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:32Z",
"dateUpdated": "2026-10-02T04:57:32Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0398"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GHSA-F338-C843-J6JP
Vulnerability from github – Published: 2026-08-18 00:30 – Updated: 2026-09-14 21:31
VLAI
Details
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-64715"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-17T22:17:17Z",
"severity": "MODERATE"
},
"details": "A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process crash.",
"id": "GHSA-f338-c843-j6jp",
"modified": "2026-09-14T21:31:18Z",
"published": "2026-08-18T00:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64715"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/148281"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/148282"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/148286"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/148287"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149036"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149037"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149038"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
NCSC-2026-0317
Vulnerability from csaf_ncscnl - Published: 2026-08-20 06:53 - Updated: 2026-08-20 06:53Summary
Kwetsbaarheden verholpen in Apple macOS
Scope
28 vulnerabilities in this advisory, including CVE-2026-64715.
CVE-2026-64715
A use-after-free vulnerability in multiple Apple operating systems was fixed by enhancing memory management to prevent unexpected process crashes caused by malicious web content.
6.5 (Medium)
Known affected: 1 product
NCSC-2026-0319
Vulnerability from csaf_ncscnl - Published: 2026-08-20 06:59 - Updated: 2026-08-20 06:59Summary
Kwetsbaarheden verholpen in Apple iOS en iPadOS
Scope
122 vulnerabilities in this advisory, including CVE-2026-64715.
CVE-2026-64715
A use-after-free vulnerability in multiple Apple operating systems was fixed by enhancing memory management to prevent unexpected process crashes caused by malicious web content.
6.5 (Medium)
Known affected: 2 products
RHSA-2026:69098
Vulnerability from csaf_opensuse - Published: 2026-09-21 05:19 - Updated: 2026-10-03 09:28Summary
Red Hat Security Advisory: webkit2gtk3 security update
Severity
Important
Scope
227 vulnerabilities in this advisory, including CVE-2026-64715.
CVE-2026-64715
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.
8.8 (High)
Fixed: 46 products
https://access.redhat.com/errata/RHSA-2026:69098
RHSA-2026:74084
Vulnerability from csaf_redhat - Published: 2026-09-30 20:16 - Updated: 2026-10-03 09:29Summary
Red Hat Security Advisory: webkit2gtk3 security update
Severity
Critical
Scope
323 vulnerabilities in this advisory, including CVE-2026-64715.
CVE-2026-64715
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.
8.8 (High)
Fixed: 46 products
https://access.redhat.com/errata/RHSA-2026:74084
WID-SEC-W-2026-3352
Vulnerability from csaf_certbund - Published: 2026-09-14 22:00 - Updated: 2026-09-29 22:00Summary
Apple iOS, iPadOS, macOS Tahoe, macOS Golden Gate, macOS Sequoia und Safari: Mehrere Schwachstellen
Severity
Hoch
Scope
273 vulnerabilities in this advisory, including CVE-2026-64715.
CVE-2026-64715
Known affected: 8 products
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…
Loading…