Executive brief
AppleDouble is a file system component responsible for handling disk image mounting on Apple devices. A maliciously crafted disk image can trigger an out-of-bounds write vulnerability, causing unexpected system crashes and potential denial of service when users mount untrusted disk images.
Technical details
CVE-2026-84519 is an out-of-bounds write vulnerability in Apple's AppleDouble component, which handles extended file attributes and disk image mounting operations. The root cause stems from insufficient bounds checking when processing maliciously crafted files within disk images. An attacker can craft a malicious disk image file that, when mounted by a user, triggers the out-of-bounds write condition. The attack vector requires user interaction (mounting a disk image) but no authentication is needed. Successful exploitation results in unexpected process or system termination, leading to denial of service. The vulnerability is fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 through improved bounds checking.
Affected products
- Apple iOS before 26.7 and before 27
- Apple iPadOS before 26.7 and before 27
- Apple macOS Golden Gate before 27
- Apple macOS Sequoia before 15.8
- Apple macOS Tahoe before 26.7
Timeline
- 2026-09-14: disclosed: CVE-2026-84519 disclosed and patched in iOS 27, iPadOS 27, macOS Golden Gate 27, and other OS releases