CVE-2026-84531: Apple iOS and iPadOS out-of-bounds write in Accelerate Framework

Executive brief

The Accelerate Framework is a core system library used by iOS and iPadOS apps to process images and multimedia. A flaw in bounds checking allows an attacker to send a maliciously crafted image that causes the app to crash unexpectedly, potentially disrupting user workflows or service availability. The issue affects iPhones and iPads running iOS/iPadOS 26 and earlier.

Technical details

This is an out-of-bounds write vulnerability in the Accelerate Framework's image processing logic. The root cause is insufficient bounds checking when handling maliciously crafted image data. An attacker can craft a malicious image file and deliver it through network, email, messaging, or app upload mechanisms to trigger the flaw. Successful exploitation leads to unexpected app termination (denial of service), and potentially could allow memory corruption. The vulnerability is fixed in iOS 27 and iPadOS 27 through improved bounds checking.

Affected products

• Apple iOS before 27
• Apple iPadOS before 27

Timeline

• 2026-09-14: disclosed
• 2026-09-14: patched: iOS 27 and iPadOS 27 released

References

• https://support.apple.com/en-us/149034
• https://support.apple.com/en-us/149035