ZeroHour

CVE-2026-84607

mass

Sandbox-Escaping Kernel Race Condition in Apple iOS, macOS, and Other OSes

CVSS 3.1
7.8 high
EPSS
Published
()
Modified
AI analysis

CVE-2026-84607 is a race condition (CWE-362) in Apple's operating systems that was fixed with improved state management, allowing a sandboxed app to execute arbitrary code with kernel privileges. Exploitation requires a malicious or compromised app already running on the device (local vector, low privileges, no user interaction), which then abuses a timing window in kernel state handling to break out of the sandbox. A successful exploit yields full kernel-level code execution — the highest privilege tier on Apple platforms — making this a prime component for chaining with initial-code-execution bugs such as browser or app flaws. All iPhones, iPads, Macs, Apple TVs, Apple Watches, and Vision Pros running OS versions older than the listed fixes are affected. No public proof of concept exists, the flaw is not on CISA's KEV list, and no exploitation in the wild has been reported.

What to do: Patch all Apple devices to the fixed releases — iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 — and use MDM to push and verify updates fleet-wide. Because this flaw converts any sandboxed-app foothold into kernel code execution, it is a high-value chaining link; restrict sideloaded or untrusted apps and monitor for anomalous behavior from third-party software on unpatched devices.

Affected
Apple iOSprior to 26.7 (26.x line) and prior to 27
Apple iPadOSprior to 26.7 (26.x line) and prior to 27
Apple macOS Sequoiaprior to 15.8
Apple macOS Tahoeprior to 26.7
Apple macOS Golden Gateprior to 27
Apple tvOSprior to 27
Apple visionOSprior to 27
Apple watchOSprior to 27
Estimated exposure
masspotentially hundreds of millions of devices (subset of Apple's ~2B+ active devices not yet updated) — Apple has publicly reported an installed base of over 2 billion active devices, and every device not yet running the listed fixed OS versions remains vulnerable.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

A race condition was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A sandboxed app may be able to execute arbitrary code with kernel privileges.

Vendors
apple
Products
ipados, iphone os, macos, tvos, visionos, watchos
Weakness
CWE-362
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

In the news

Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices

Apple's coordinated rollout patches 273 unique vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS and Safari, including remote code execution flaws.

Apple shipped one of its largest coordinated security updates on September 14, 2026, fixing 273 unique CVEs across iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27 and Xcode 27. Highlights include CVE-2026-65414, a Bluetooth out-of-bounds write enabling remote code execution, and CVE-2026-84607, an AVEVideoEncoder race condition granting kernel privileges to sandboxed apps. macOS Golden Gate 27 covers the broadest set with 210 CVEs, and Apple states none of the flaws were exploited in the wild.