CVE-2026-84561

CVE-2026-84561 is a double-free memory-corruption flaw (CWE-415) in the kernel of Apple's operating systems, resolved through improved memory management. Although the CVSS vector is scored with a network attack vector, Apple's advisory describes a locally running app as the trigger: a malicious or compromised app on the device can trip the double free in kernel code. The result, per Apple, is unexpected system termination or corruption of kernel memory — a denial-of-service condition, with kernel memory corruption potentially usable as a building block for further exploitation. All users of iPhones, iPads, Macs, Apple TVs, Apple Vision Pro headsets and Apple Watches running versions older than the fixed releases are affected. There is currently no evidence of in-the-wild exploitation, no CISA KEV listing, and no known public proof-of-concept.

What to do: Update devices to iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 or watchOS 27. Verify fleet OS versions via MDM or Settings > General > Software Update and prioritize user-facing iOS/macOS devices. Until patched, limit risk by avoiding untrusted app installs, since a local app is the documented trigger; no other workaround is available.