Executive brief
Apple's Accelerate Framework is a core system library used across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS for high-performance math and image processing. An attacker can crash applications or unexpectedly terminate them by crafting a malicious image file. This vulnerability could disrupt user experience and be chained with other exploits to achieve greater impact.
Technical details
An out-of-bounds write vulnerability exists in the Accelerate Framework's image processing code. The vulnerability is triggered when the framework processes a specially crafted image file, causing a buffer overflow due to insufficient bounds checking. Attack requires no authentication or special privileges; an attacker simply needs to deliver a malicious image to a user or application. Successful exploitation leads to unexpected process termination (denial of service). Apple addressed this issue with improved bounds checking in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, released September 14, 2026.
Affected products
- Apple iOS before 27
- Apple iPadOS before 27
- Apple macOS Golden Gate before 27
- Apple tvOS before 27
- Apple visionOS before 27
- Apple watchOS before 27
Timeline
- 2026-09-14: patched: Fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27
- 2026-09-14: advisory