CVE-2026-86959

Undergoing Analysis Undergoing Analysis - In Progress

Memory Corruption in Apple iOS and macOS via Malicious Image

Publication date: 2026-10-20

Last updated on: 2026-11-09

Assigner: Apple Inc.

Description

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to unexpected process termination.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-09

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-86959

EUVD

EUVD-2026-104733

Affected Vendors & Products

Vendor	Product	Version / Range
apple	macos	to 15.8 (exc)
apple	ipados	to 26.7 (exc)
apple	iphone_os	to 26.7 (exc)
apple	macos	From 26.0 (inc) to 26.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This is an input validation issue in Apple's operating systems where processing a maliciously crafted image could cause an unexpected process termination. It affects iOS, iPadOS, and macOS versions including iOS 26.7, iOS 27, macOS Golden Gate 27, and others.

Detection Guidance

This vulnerability involves processing maliciously crafted images leading to unexpected process termination. Detection may require monitoring for crashes or unusual behavior in image processing applications. Check for updates to iOS, iPadOS, or macOS versions mentioned in the advisory.

Impact Analysis

The vulnerability could allow an attacker to crash applications or processes by tricking a user into opening a specially crafted image file. This may lead to denial of service or unexpected app termination on affected devices.

Compliance Impact

The provided CVE data does not specify how this vulnerability affects compliance with standards like GDPR or HIPAA. The issue involves unexpected process termination due to maliciously crafted images, but no direct impact on regulatory compliance is mentioned.

Mitigation Strategies

Update affected Apple devices to the latest versions: iOS 26.7 or later, iOS 27 or later, iPadOS 26.7 or later, iPadOS 27 or later, macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7. Avoid processing untrusted images until updates are applied.

Hi! I’m here to help you understand CVE-2026-86959. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...