Apple tvOS: 25 Vulnerabilities Patched in Same-Day Disclosure
Key findings • Apple patched 25 vulnerabilities in tvOS disclosed on September 14, 2026. • Vulnerabilities include privacy risks, data access issues, and system stability flaws. • Fixes a…
Key findings
- Apple patched 25 vulnerabilities in tvOS disclosed on September 14, 2026.
- Vulnerabilities include privacy risks, data access issues, and system stability flaws.
- Fixes are available in tvOS 27 and some in the 26.7 branch.
- No vulnerabilities were reported as actively exploited in the wild.
- Issues range from out-of-bounds reads/writes to logic flaws and race conditions.
On September 14, 2026, Apple Inc. released a significant security update addressing a batch of 25 vulnerabilities in tvOS, alongside updates for iOS, iPadOS, macOS, watchOS, and visionOS. The disclosures, all published on the same day, highlight a range of issues including memory corruption, privacy concerns, and potential data access vulnerabilities. These vulnerabilities, patched in tvOS 27, represent a broad set of security enhancements across Apple's ecosystem.
The vulnerabilities disclosed can be broadly categorized by their impact and the underlying bug class. Several issues relate to memory handling, including out-of-bounds reads and writes, integer overflows, and memory initialization flaws, which could lead to memory corruption or disclosure of sensitive kernel memory. For instance, CVE-2026-86903 and CVE-2026-84530 involve out-of-bounds reads that could disclose kernel memory, while CVE-2026-84607, a race condition, could allow a sandboxed app to execute arbitrary code with kernel privileges. CVE-2026-84620 describes an integer overflow that could lead to memory corruption when processing a maliciously crafted 3D model.
Other vulnerabilities focus on authorization and permissions, allowing apps to access sensitive user data, persistent account identifiers, or even modify protected system files. CVE-2026-84636 and CVE-2026-84617 are examples of authorization issues that could lead to access to sensitive user data. Similarly, CVE-2026-84609, a permissions issue, could allow an app to modify protected system files. CVE-2026-84628, another authorization flaw, could permit a sandboxed app to access the System Keychain.
Privacy concerns are also prominent, with several CVEs detailing how an app might be able to fingerprint the user or identify installed applications. CVE-2026-84629 addresses an issue where an app may be able to fingerprint the user, and CVE-2026-84626 describes an information disclosure flaw that could reveal which other apps a user has installed. Additionally, a cryptographic issue, CVE-2026-84533, could allow an attacker in a privileged network position to modify network traffic.
The batch also includes vulnerabilities that could lead to unexpected process or system termination. CVE-2026-84635, a logic issue, and CVE-2026-84575, an out-of-bounds write, could result in unexpected process termination. CVE-2026-84571 and CVE-2026-84511 also describe out-of-bounds write issues that could lead to unexpected app termination.
According to related security reporting, none of these vulnerabilities were reported as actively exploited in the wild at the time of disclosure. The fixes for these issues are available in tvOS 27, with some related fixes also appearing in earlier versions like tvOS 26.7 for specific CVEs.
This coordinated disclosure of 25 vulnerabilities underscores the importance of timely updates for Apple devices. Users of tvOS are advised to update to tvOS 27 to ensure their devices are protected against these potential security risks, which range from information disclosure and privacy violations to system stability issues and the potential for arbitrary code execution. The broad nature of these fixes across multiple Apple operating systems highlights a comprehensive security effort by the vendor.