Executive brief
Apple's Accelerate Framework is a low-level library used by apps to perform image processing and other computational tasks. A memory corruption vulnerability allows a maliciously crafted image file to crash applications unexpectedly. An attacker could exploit this by distributing a malicious image file that, when processed by vulnerable apps, causes denial of service.
Technical details
An out-of-bounds write issue in the Accelerate Framework was addressed with improved bounds checking. The vulnerability occurs when processing a maliciously crafted image file, leading to unexpected process termination. The vulnerability is reachable via file processing without authentication, and can result in denial of service through app crashes. Apple patched this issue in iOS 27 and iPadOS 27 (released September 14, 2026), and also in macOS Golden Gate 27.
Affected products
- Apple iOS prior to 27
- Apple iPadOS prior to 27
- Apple macOS prior to Golden Gate 27
Timeline
- 2026-09-14: patched: iOS 27, iPadOS 27, and macOS Golden Gate 27 released
- 2026-09-14: disclosed