medium · CVSS v3 4.3 · EPSS 0.00152

CVE-2026-86975

An out-of-bounds read in image processing was fixed in Apple OS 27 releases. The vulnerability could cause unexpected process termination wh

Overview

An out-of-bounds read in image processing was fixed in Apple OS 27 releases. The vulnerability could cause unexpected process termination when handling malicious images. It affects all Apple operating systems prior to version 27.

Description

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected process termination.

Impact

The flaw can lead to denial of service by terminating processes that handle images, compromising availability for users and administrators of affected Apple operating systems. Confidentiality and integrity are not directly impacted.

Remediation

Apply the latest OS updates (iOS 27, iPadOS 27, macOS 27, tvOS 27, visionOS 27, watchOS 27). If updating is not possible, restrict image processing from untrusted sources, use sandboxing, monitor for abnormal process termination, and apply vendor security advisories.

Risk context

The CVE has a medium severity score of 4.3 and a very low EPSS of 0.00152, indicating a low likelihood of exploitation in the wild. Nonetheless, updating mitigates the risk.

Affected products

  • Apple iOS
  • Apple iPadOS
  • Apple macOS
  • Apple tvOS
  • Apple visionOS
  • Apple watchOS

Scores

Severity
medium
CVSS v2
5
CVSS v3
4.3
CVSS v4
—
EPSS
0.00152

out-of-bounds image-processing denial-of-service Apple iOS macOS patch

← All CVEs

Related CVEs

medium

CVE-2026-96902

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.

View analysis

medium

CVE-2026-8355

IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during OAuth-enabled gateway registration when the system fails to validate the oauth_config.token_url parameter. When registering a gateway with OAuth client credentials authentication, an attacker can supply a malicious token_url pointing to internal services, cloud metadata endpoints (AWS IMDSv1, GCP, Azure), or localhost-bound services. The application immediately performs an HTTP POST request to the attacker-controlled URL with form-encoded credentials in the body. If the response cannot be parsed as a valid OAuth token response, up to 256 characters of the response body are reflected back to the attacker in the HTTP 502 error message. This vulnerability bypasses existing SSRF protections that are applied to the gateway.url field but not to OAuth configuration parameters.

View analysis

medium

CVE-2026-109441

LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled. Authenticated users with code execution in their own sandbox can connect directly to other tenants' containers, bypassing require_workspace_owner checks to read files such as vault secrets from exposed servers.

View analysis

medium

CVE-2026-28850

An authorization issue was addressed with improved state management. This issue is fixed in visionOS 27. An app may be able to access sensitive user data.

View analysis