Executive brief
The Accelerate Framework is a system library used by iOS and iPadOS apps to process images and perform computational tasks. A flaw in image processing could allow an app to craft a malicious image that causes the system to unexpectedly terminate, disrupting user service and potentially causing data loss if unsaved work is present.
Technical details
An out-of-bounds write vulnerability exists in the Accelerate Framework's image processing component, addressed by improved bounds checking. The vulnerability is triggered when processing a maliciously crafted image file, leading to unexpected process termination (denial of service). The attack requires local execution context (an app must run on the device), but no authentication or additional preconditions are needed. An attacker can cause immediate service disruption. The fix is available in iOS 27, iPadOS 27, and corresponding macOS releases (Golden Gate 27, Tahoe 26.7).
Affected products
- Apple iOS 26.7, 27 and later
- Apple iPadOS 26.7, 27 and later
- Apple macOS Golden Gate 27 and later
- Apple macOS Tahoe 26.7 and later
- Apple tvOS 27 and later
- Apple visionOS 27 and later
- Apple watchOS 27 and later
Timeline
- 2026-09-14: patched: iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27 released
- 2026-09-14: advisory: CVE-2026-65410 published