Apple iOS: 25 Vulnerabilities Patched Together, Ranging from Data Access to Kernel Privilege Escalation
Key findings • Apple patched 25 vulnerabilities across its operating systems on October 26, 2026, including iOS, iPadOS, and macOS. • Vulnerabilities range from memory corruption and buffer o…
Key findings
- Apple patched 25 vulnerabilities across its operating systems on October 26, 2026, including iOS, iPadOS, and macOS.
- Vulnerabilities range from memory corruption and buffer overflows to authorization bypasses and unauthorized access to sensitive data.
- Key risks include potential for arbitrary code execution with kernel privileges (CVE-2026-86916) and unauthorized camera access (CVE-2026-86990).
- No vulnerabilities in this batch were reported as actively exploited in the wild.
- Patches were released for multiple versions, including iOS 26.7.2, 27.2 and macOS Golden Gate 27.2.
On October 26, 2026, Apple Inc. disclosed a significant batch of 25 vulnerabilities affecting its iOS and iPadOS operating systems, alongside other platforms including macOS, tvOS, visionOS, and watchOS. These vulnerabilities, patched in various versions such as iOS 26.7.2, iOS 27.2, and macOS Golden Gate 27.2, span a range of security risks, from unauthorized access to sensitive data and camera functions to memory corruption and unexpected application or system termination.
The disclosed vulnerabilities can be broadly categorized by their impact and the underlying bug classes. Several issues relate to memory handling, including buffer overflows (CVE-2026-86991, CVE-2026-86972), use-after-free bugs (CVE-2026-86986, CVE-2026-86916), out-of-bounds reads (CVE-2026-86970, CVE-2026-86973, CVE-2026-86954, CVE-2026-86942), and out-of-bounds writes (CVE-2026-86971, CVE-2026-86969). These memory-related flaws could lead to unexpected application termination, memory corruption, or even arbitrary code execution with kernel privileges in the case of CVE-2026-86916.
Other vulnerabilities focus on authorization and access control issues. CVE-2026-86990 and CVE-2026-86968 describe flaws where a malicious app might gain access to the camera or restricted system interfaces without proper user permission. Several CVEs, including CVE-2026-86989, CVE-2026-86987, CVE-2026-86978, CVE-2026-86925, CVE-2026-86920, and CVE-2026-86880, highlight authorization issues that could allow an app to fingerprint users or access sensitive user data. Additionally, CVE-2026-86966 points to a symlink issue that could permit an app to modify protected file system areas.
The batch also includes vulnerabilities related to unexpected app termination and denial-of-service conditions. CVE-2026-86992, for instance, involves improved memory handling to prevent app termination when processing a crafted video file. Similarly, CVE-2026-86985 and CVE-2026-86974, involving improved input validation and type confusion respectively, could lead to unexpected process termination or memory corruption when processing crafted web content. CVE-2026-86964, a null pointer dereference, and CVE-2026-86942, an out-of-bounds read, could also result in unexpected system termination or denial-of-service. CVE-2026-84634, a race condition, could lead to unexpected system termination or kernel memory writes.
While the SANS Internet Storm Center noted that Apple released patches for a large number of vulnerabilities, it did not indicate that any of the CVEs in this specific batch were being actively exploited in the wild. Similarly, Vypr Intelligence reported that no vulnerabilities in this batch were reported as actively exploited. The fixes were rolled out across multiple operating system versions, including iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2, among others.
Users of Apple devices are strongly advised to update their systems to the latest available versions to mitigate these security risks. The broad range of vulnerabilities patched underscores the importance of timely security updates for maintaining the integrity and security of personal data and device functionality. The consistent patching across multiple platforms highlights Apple's ongoing efforts to address security vulnerabilities across its ecosystem.