CVE-2026-84575

CVE-2026-84575 is an out-of-bounds write (CWE-787) in Apple's operating systems that was fixed with improved bounds checking in the iOS 27-generation releases. The flaw is triggered when an affected device processes a maliciously crafted file, causing unexpected app termination, and the CVSS 3.1 vector (C:H/I:H/A:H) indicates successful corruption could extend to confidentiality, integrity, and availability, including potential code execution. All versions of iOS, iPadOS, macOS (Sequoia, Tahoe, and Golden Gate lines), tvOS, visionOS, and watchOS prior to the listed fixed releases are affected. This spans essentially the entire modern Apple device ecosystem, from iPhones and Macs to Apple TV, Apple Watch, and Apple Vision Pro. There is no known public proof of concept and the issue is not on the CISA KEV catalog, so exploitation is currently none known.

What to do: Patch all Apple devices to the fixed releases: iOS 27 / iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. In managed fleets, enforce these minimum OS versions via MDM and audit for lagging devices. Advise users to avoid opening files from untrusted sources, since exploitation requires processing a maliciously crafted file on the local device.