CVE-2026-86870: Apple iOS, iPadOS, macOS, visionOS, watchOS heap buffer overflow in Accelerate Framework

CVE-2026-86870 · Severity: medium · CVSS 6.5 · Published 2026-09-14

The Accelerate Framework is a core component used by iOS, iPadOS, macOS, visionOS, and watchOS to optimize performance-critical image and signal processing. A heap buffer overflow in this framework allows attackers to trigger a denial-of-service condition by processing specially crafted image files, causing unexpected app or system termination.

Technologies: Apple iPadOS, Apple Iphone Os, Apple macOS, Apple Visionos, Apple watchOS. Vendors: Apple.

Quick answers

Is CVE-2026-86870 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-86870 being exploited in the wild.
How severe is CVE-2026-86870?
Medium severity, with a CVSS score of 6.5, published 14 September 2026.
Which products and versions are affected?
Apple iPadOS before 26.7, before 27; Apple macOS before Golden Gate 27; Apple Visionos before 27; Apple watchOS before 27.
Is there a fix for CVE-2026-86870?
A patch was published on 2026-09-14: Fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86870 attacked?
It is attacked over the network or with local access, in an operating system.
Am I affected by CVE-2026-86870?
Check whether you run Apple iPadOS, Apple Iphone Os, Apple macOS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap buffer overflow vulnerability exists in Apple's Accelerate Framework due to insufficient bounds checking during image processing. The vulnerability is triggered when processing a maliciously crafted image file, allowing an attacker to write out-of-bounds to heap memory. The attack requires user interaction (opening or processing a malicious file) but does not require authentication or elevated privileges. Successful exploitation results in unexpected process termination (denial of service); the advisory does not indicate arbitrary code execution capability. Apple addressed this issue with improved bounds checking in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27 (released September 14, 2026).

Affected products

  • Apple iOS before 26.7, before 27
  • Apple iPadOS before 26.7, before 27
  • Apple macOS before Golden Gate 27
  • Apple visionOS before 27
  • Apple watchOS before 27

Timeline

  • 2026-09-14: patched: Fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27
  • 2026-09-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.