CVE-2026-84611

An out-of-bounds write (CWE-787) in Apple's 3D model processing code can corrupt memory when a maliciously crafted 3D model is parsed. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R, 7.3 High) indicates a local attack that requires the victim to open or preview the malicious model file, but needs only low privileges to succeed. Successful exploitation could yield memory corruption with high impact on confidentiality, integrity, and availability, plausibly including code execution in the context of the app rendering the model. The flaw spans Apple's major platforms — iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate branches), tvOS, visionOS, and watchOS — and was fixed with improved bounds checking in the versions listed by Apple. No public proof-of-concept is known and the issue is not in CISA's KEV catalog, so no exploitation in the wild has been reported.

What to do: Patch to the fixed releases: iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Until updated, avoid opening unsolicited 3D model files or AR/model content received via messages, mail, or untrusted sources. MDM and IT administrators should verify OS patch compliance across managed fleets of all affected Apple device types.