Executive brief
Apple's AppleKeyStore component, which manages cryptographic keys and authentication credentials on iOS and iPadOS devices, contains a memory management vulnerability that could allow a local app to crash the system or potentially cause other unexpected behavior. This issue affects all modern iPhones and iPads, and patches are available through iOS 27 and iPadOS 27 updates.
Technical details
CVE-2026-84593 is a use-after-free vulnerability in AppleKeyStore, addressed with improved memory management. The vulnerability allows a local attacker (an installed app) to trigger unexpected system termination by manipulating memory references after they have been freed. The attack requires no user interaction beyond having an app installed on the device. Apple patched this issue in iOS 27 and iPadOS 27 released on September 14, 2026. The vulnerability is classified as medium severity with a CVSS score of 5.5.
Affected products
- Apple iOS before 27
- Apple iPadOS before 27
Timeline
- 2026-09-14: patched: Fixed in iOS 27 and iPadOS 27
- 2026-09-14: disclosed