Apple visionOS: 25 Vulnerabilities Patched in Same-Day Disclosure
Key findings • Apple patched 25 vulnerabilities in visionOS, disclosed on September 14, 2026. • Vulnerabilities include privacy risks, data access issues, and system stability flaws. • Fi…
Key findings
- Apple patched 25 vulnerabilities in visionOS, disclosed on September 14, 2026.
- Vulnerabilities include privacy risks, data access issues, and system stability flaws.
- Fixes are available in visionOS 27 and other Apple operating systems.
- No vulnerabilities were reported as actively exploited in the wild.
- Issues range from out-of-bounds reads/writes to logic flaws and race conditions.
On September 14, 2026, Apple Inc. released a significant security update addressing a batch of 25 vulnerabilities across its visionOS operating system, alongside updates for iOS, iPadOS, macOS, watchOS, and tvOS. The disclosures, all published on the same day, highlight a range of issues including memory corruption, privacy concerns, and potential data access vulnerabilities. These vulnerabilities were patched in visionOS 27.
Several vulnerabilities relate to an app's ability to access sensitive user data or identify users. CVE-2026-86897, CVE-2026-86883, and CVE-2026-84603 are examples where an app may gain unauthorized access to sensitive user data due to issues with entitlement checks, file handling, or general permissions. Additionally, CVE-2026-86892 and CVE-2026-84625 mention an app's ability to cause a denial-of-service or fingerprint the user, respectively, also due to entitlement checks and sandbox restrictions. Privacy concerns are further highlighted by CVE-2026-86887, which allowed an app to bypass certain privacy preferences, and CVE-2026-84606, where an app could identify a user across reinstalls due to improved handling of identifiers.
Memory corruption and potential for arbitrary code execution are also present in this batch. CVE-2026-84620 and CVE-2026-84546 describe an integer overflow and an out-of-bounds write, respectively, that could lead to memory corruption when processing maliciously crafted 3D models. A more severe vulnerability, CVE-2026-84607, a race condition, could allow a sandboxed app to execute arbitrary code with kernel privileges. Another out-of-bounds write, CVE-2026-86876, could allow a sandboxed process to circumvent sandbox restrictions.
Other vulnerabilities include an out-of-bounds read in CVE-2026-86903, which could lead to the disclosure of kernel memory, and a logic issue in CVE-2026-86898, which could lead to universal cross-site scripting when opening a maliciously crafted webarchive file. CVE-2026-84628 and CVE-2026-84600 represent authorization issues where a sandboxed app could access the System Keychain or a malicious shortcut could send messages without user confirmation. CVE-2026-84626 details an information disclosure issue where an app may identify what other apps a user has installed.
All 25 vulnerabilities were addressed in visionOS 27. Related advisories indicate that these fixes were also included in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, and watchOS 27, with some fixes appearing in the 26.7 branch for iOS, iPadOS, macOS Tahoe, and macOS Sequoia. No vulnerabilities were reported as actively exploited in the wild.
This batch of vulnerabilities underscores the importance of timely updates for Apple's operating systems. Users of visionOS and other affected Apple platforms should ensure they are running the latest available software versions to protect against potential data access, privacy breaches, and system instability. The wide range of issues patched indicates a comprehensive security review and update from Apple.