CVE-2026-86876

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Write in Apple iOS and macOS

Publication date: 2026-09-14

Last updated on: 2026-09-15

Assigner: Apple Inc.

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. A sandboxed process may be able to circumvent sandbox restrictions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-15

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-86876

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 26.7 (exc)
apple	iphone_os	to 26.7 (exc)
apple	macos	From 15.0 (inc) to 15.8 (exc)
apple	macos	From 26.0 (inc) to 26.7 (exc)
apple	visionos	to 27.0 (exc)
apple	watchos	to 27.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is an out-of-bounds write vulnerability caused by insufficient bounds checking. A sandboxed process could exploit this to write data outside its allocated memory space, potentially bypassing sandbox restrictions and gaining unauthorized access to system resources or data.

Detection Guidance

This vulnerability is specific to Apple operating systems and relates to sandbox restrictions. Detection typically requires checking system updates rather than network commands. Ensure all Apple devices are updated to iOS 26.7 or later, iPadOS 26.7 or later, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, or watchOS 27.

Impact Analysis

If exploited, this vulnerability could allow an attacker to escape the sandbox environment on your device. This might lead to unauthorized access to sensitive data, execution of arbitrary code, or installation of malicious software on your system.

Compliance Impact

The vulnerability allows a sandboxed process to bypass restrictions, which could lead to unauthorized access or data exfiltration. This may impact compliance with GDPR (data protection) and HIPAA (health data privacy) by increasing the risk of data breaches or unauthorized processing.

Mitigation Strategies

Update affected Apple devices to the latest versions mentioned in the CVE description (iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27) to address the out-of-bounds write issue.

Hi! I’m here to help you understand CVE-2026-86876. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70