Executive brief
iOS and iPadOS include image processing code that fails to properly validate memory boundaries when handling specially crafted images. An attacker who tricks a user into opening a malicious image file could execute arbitrary code with the privileges of the affected application, potentially gaining access to sensitive data or controlling device functionality.
Technical details
This vulnerability is a memory corruption issue—specifically an out-of-bounds write—that occurs during image processing. The vulnerable code fails to enforce proper bounds checking when parsing maliciously crafted image files. An attacker must convince a user to open or process a malicious image (via email, web, messaging, etc.), triggering the out-of-bounds write in memory. Successful exploitation leads to arbitrary code execution in the context of the application handling the image. Apple's fix involved removing the vulnerable code path. The issue was patched in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 released on September 14, 2026.
Affected products
- Apple iOS before 27
- Apple iPadOS before 27
- Apple macOS Golden Gate before 27
- Apple visionOS before 27
Timeline
- 2026-09-14: disclosed: Fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27
- 2026-09-14: patched