ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2026-84616

PoC mass

Type confusion flaw in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS causes system crashes

CVSS
—
EPSS
<1%p7
Published
()
Modified
AI analysis

CVE-2026-84616 is a type confusion memory-handling flaw in Apple's operating systems, assigned by Apple's product security team. It is triggered by a malicious app running locally on the device, which can confuse data types in memory and crash the system. The stated impact is unexpected system termination — effectively a local denial-of-service — rather than code execution or data theft. All users of iPhone, iPad, Mac, Apple TV, Apple Vision Pro and Apple Watch running versions older than the fixed releases are affected. Exploitation has not been confirmed in the wild (EPSS ~0.2%, no CISA KEV entry), but one public proof-of-concept repository exists and the CVSS score is still pending.

What to do: Update devices to the fixed releases: iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Because exploitation requires running a local app, avoid installing untrusted or sideloaded apps until patched. Enterprise administrators should use MDM reporting to inventory OS versions across managed fleets and prioritize devices left on older branches (e.g., macOS Sequoia earlier than 15.8).

Affected
Apple iOSall versions prior to 26.7 (fixed in iOS 26.7 and iOS 27)
Apple iPadOSall versions prior to 26.7 (fixed in iPadOS 26.7 and iPadOS 27)
Apple macOS Sequoiaall versions prior to 15.8 (fixed in macOS Sequoia 15.8)
Apple macOS Tahoeall versions prior to 26.7 (fixed in macOS Tahoe 26.7)
Apple macOS Golden Gateall versions prior to 27 (fixed in macOS Golden Gate 27)
Apple tvOSall versions prior to 27 (fixed in tvOS 27)
Apple visionOSall versions prior to 27 (fixed in visionOS 27)
Apple watchOSall versions prior to 27 (fixed in watchOS 27)
Estimated exposure
mass≈1 billion+ consumer Apple devices (a large share of Apple's reported >2 billion active devices still run pre-fix OS builds) — Apple has publicly stated an active installed base of over 2 billion devices, and historical adoption patterns show a majority of iPhone, iPad, Mac, Apple TV, Apple Watch and Vision Pro users remain on older OS versions for weeks to months…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news

No ingested article mentions this CVE yet.