Apple iOS/iPadOS: 25 Vulnerabilities Disclosed Together, Ranging from Data Access to System Stability
Key findings • Apple patched 25 vulnerabilities in iOS and iPadOS disclosed on October 26, 2026. • Vulnerabilities include unauthorized data access, camera access, and potential system instab…
Key findings
- Apple patched 25 vulnerabilities in iOS and iPadOS disclosed on October 26, 2026.
- Vulnerabilities include unauthorized data access, camera access, and potential system instability.
- The batch features issues like buffer overflows, memory corruption, and authorization bypasses.
- No vulnerabilities in this batch were reported as actively exploited in the wild.
- Patches were released across multiple Apple operating systems and versions.
On October 26, 2026, Apple Inc. disclosed a significant batch of 25 vulnerabilities affecting its iOS and iPadOS operating systems, alongside other platforms including macOS, tvOS, watchOS, and visionOS. The vulnerabilities, all disclosed on the same day, range in severity and impact, with several allowing malicious applications to access sensitive user data, camera, or system interfaces without permission. The batch includes issues such as buffer overflows, memory corruption, type confusion, and authorization bypasses, stemming from improper handling of various file types including video, images, and audio, as well as web content and fonts.
Several vulnerabilities specifically address the risk of unauthorized access to sensitive user data. CVE-2026-86989 and CVE-2026-86925, for instance, were addressed with improved state management, preventing apps from fingerprinting users or accessing sensitive data. Similarly, CVE-2026-86986 and CVE-2026-86920 were patched due to authorization issues that could allow remote attackers to access sensitive user data. CVE-2026-86880 was also fixed with additional entitlement checks to prevent unauthorized access to sensitive user data.
Other vulnerabilities in this batch focus on preventing system instability and unauthorized actions. CVE-2026-86991, a buffer overflow addressed with improved bounds checking, could lead to unexpected process termination. CVE-2026-86990, an access issue fixed with improved access restrictions, could allow a malicious app to access the camera without user permission. Furthermore, CVE-2026-86954, an out-of-bounds read, could lead to unexpected app termination after processing a maliciously crafted image. CVE-2026-86969, an out-of-bounds write, could result in unexpected system termination or kernel memory corruption.
The batch also includes several vulnerabilities related to web content processing. CVE-2026-86985 and CVE-2026-86974, addressed with improved input validation and checks respectively, could lead to unexpected process crashes or memory corruption when processing maliciously crafted web content. CVE-2026-86973 and CVE-2026-86971, both out-of-bounds read and write issues, respectively, also stemmed from processing malicious web content and could lead to process crashes or app termination. CVE-2026-86966, related to symlink handling, could allow an app to modify protected file system parts.
Apple addressed these vulnerabilities through various updates, including iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2. Specific fixes were also noted for Safari 27.2 and earlier versions like iOS 18.7.11 and iPadOS 18.7.11. Notably, none of the vulnerabilities in this batch were reported as actively exploited in the wild, according to Vypr Intelligence.
This coordinated disclosure highlights Apple's ongoing efforts to secure its ecosystem against a wide array of potential threats. Users are advised to update their devices to the latest available versions to mitigate risks associated with these vulnerabilities, which span from data access to potential system instability. The consistent patching across multiple operating systems underscores the interconnected nature of security within Apple's product lines.