medium · CVSS v3 4.6 · EPSS 0.00152

CVE-2026-86953

An out‑of‑bounds write flaw in Apple’s operating systems was patched in version 27. The vulnerability could allow a nearby attacker to trigg

Overview

An out‑of‑bounds write flaw in Apple’s operating systems was patched in version 27. The vulnerability could allow a nearby attacker to trigger a denial‑of‑service by corrupting memory. It affects all current iOS, iPadOS, macOS, tvOS, visionOS, and watchOS releases.

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An attacker in physical proximity may be able to cause a denial-of-service.

Impact

The flaw can lead to a denial‑of‑service, disrupting availability of the affected device. It does not directly expose data or allow remote code execution. Defenders should be aware that the issue requires physical proximity to the target device. The risk is limited to local attackers.

Remediation

Apply the latest OS update (iOS 27, iPadOS 27, macOS 27, tvOS 27, visionOS 27, watchOS 27). If updates are unavailable, restrict physical access to devices and monitor for abnormal crashes. Ensure devices are running the patched firmware.

Risk context

The CVSS v3 score of 4.6 indicates medium impact, and the EPSS of 0.00152 suggests a very low likelihood of exploitation. The vulnerability is already fixed in current releases, so the urgency is moderate; update promptly to eliminate the risk.

Affected products

  • iOS 27
  • iPadOS 27
  • macOS Golden Gate 27
  • tvOS 27
  • visionOS 27
  • watchOS 27

Scores

Severity
medium
CVSS v2
4.9
CVSS v3
4.6
CVSS v4
—
EPSS
0.00152

out-of-bounds denial-of-service physical-proximity Apple iOS macOS patch

← All CVEs

Related CVEs

medium

CVE-2026-96902

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.

View analysis

medium

CVE-2026-8355

IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during OAuth-enabled gateway registration when the system fails to validate the oauth_config.token_url parameter. When registering a gateway with OAuth client credentials authentication, an attacker can supply a malicious token_url pointing to internal services, cloud metadata endpoints (AWS IMDSv1, GCP, Azure), or localhost-bound services. The application immediately performs an HTTP POST request to the attacker-controlled URL with form-encoded credentials in the body. If the response cannot be parsed as a valid OAuth token response, up to 256 characters of the response body are reflected back to the attacker in the HTTP 502 error message. This vulnerability bypasses existing SSRF protections that are applied to the gateway.url field but not to OAuth configuration parameters.

View analysis

medium

CVE-2026-109441

LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled. Authenticated users with code execution in their own sandbox can connect directly to other tenants' containers, bypassing require_workspace_owner checks to read files such as vault secrets from exposed servers.

View analysis

medium

CVE-2026-28850

An authorization issue was addressed with improved state management. This issue is fixed in visionOS 27. An app may be able to access sensitive user data.

View analysis