Is CVE-2026-65414 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65414 being exploited in the wild.

How severe is CVE-2026-65414?

Critical severity, with a CVSS score of 9.8, published 14 September 2026.

Which products and versions are affected?

Apple iPadOS before 27; Apple macOS Golden Gate before 27; Apple macOS Sequoia before 15.8; Apple macOS Tahoe before 26.7; and 3 more.

Is there a fix for CVE-2026-65414?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-65414 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-65414?

Check whether you run Apple iPadOS, Apple macOS Golden Gate, Apple macOS Sequoia or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65414: Apple iOS and iPadOS out-of-bounds write in Accelerate Framework

CVE-2026-65414 · Severity: critical · CVSS 9.8 · Published 2026-09-14

The Accelerate Framework is a core system library used by iOS and iPadOS to process images and perform mathematical computations on Apple devices. A flaw in bounds checking allows a remote attacker to trigger an out-of-bounds write by crafting a malicious image, potentially causing app crashes or arbitrary code execution on affected devices.

Technologies: Apple iPadOS, Apple macOS Golden Gate, Apple macOS Sequoia, Apple Tvos, Apple Visionos, Apple watchOS. Vendors: Apple.

Quick answers

Is CVE-2026-65414 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65414 being exploited in the wild.
How severe is CVE-2026-65414?: Critical severity, with a CVSS score of 9.8, published 14 September 2026.
Which products and versions are affected?: Apple iPadOS before 27; Apple macOS Golden Gate before 27; Apple macOS Sequoia before 15.8; Apple macOS Tahoe before 26.7; and 3 more.
Is there a fix for CVE-2026-65414?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-65414 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-65414?: Check whether you run Apple iPadOS, Apple macOS Golden Gate, Apple macOS Sequoia or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds write vulnerability exists in Apple's Accelerate Framework component, which handles image processing. The vulnerability is triggered when processing a maliciously crafted image file, allowing an attacker to write data beyond allocated buffer boundaries. The attack vector is remote (image delivery) and does not require prior authentication or user interaction beyond opening/processing the image. Successful exploitation can lead to unexpected process termination or arbitrary code execution with the privileges of the affected process. The vulnerability has been patched in iOS 27, iPadOS 27, macOS Golden Gate 27, and later OS versions.

Affected products

Apple iOS before 27
Apple iPadOS before 27
Apple macOS Golden Gate before 27
Apple macOS Sequoia before 15.8
Apple macOS Tahoe before 26.7
Apple tvOS before 27
Apple visionOS before 27
Apple watchOS before 27

Timeline

2026-09-14: disclosed: iOS 27, iPadOS 27, and related macOS versions released with patch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.