Executive brief
The Accelerate Framework is a core macOS library that processes images and performs computational tasks. A maliciously crafted image can trigger an out-of-bounds memory read, causing unexpected system crashes. While denial of service is the known impact, out-of-bounds reads can sometimes be chained with other vulnerabilities for more severe exploitation.
Technical details
CVE-2026-65364 is an out-of-bounds read vulnerability in Apple's Accelerate Framework, triggered by processing a maliciously crafted image file. The vulnerability results from insufficient bounds checking when the framework accesses memory during image processing operations. The attack requires no authentication or special privileges—a remote attacker can deliver a malicious image (e.g., via email, web download, or messaging app) that causes a crash when processed. The fix involves improved bounds checking in the vulnerable code path. Patches are available in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.
Affected products
- Apple macOS Golden Gate before 27
- Apple macOS Sequoia before 15.8
- Apple macOS Tahoe before 26.7
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Patches released in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7