CVE-2026-84519: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-84519 Overview

CVE-2026-84519 is an out-of-bounds write vulnerability [CWE-787] affecting Apple's disk image handling across iOS, iPadOS, and macOS. Mounting a disk image containing maliciously crafted files can trigger memory corruption and cause unexpected system termination. Apple addressed the issue with improved bounds checking in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The flaw requires user interaction to mount the crafted image but does not require prior authentication. No public exploit code or in-the-wild exploitation has been reported.

Critical Impact
A crafted disk image can trigger an out-of-bounds write during mount, resulting in denial of service through unexpected system termination on affected Apple devices.

Affected Products

Apple iOS and iPadOS versions prior to 26.7 and 27
Apple macOS Sequoia prior to 15.8 and macOS Tahoe prior to 26.7
Apple macOS Golden Gate prior to 27

Discovery Timeline

2026-09-14 - CVE-2026-84519 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84519

Vulnerability Analysis

The vulnerability resides in the Apple disk image mounting subsystem responsible for parsing file structures inside mounted volumes. When the mount routine processes a maliciously crafted file within a disk image, it writes data past the bounds of an allocated buffer. This out-of-bounds write corrupts adjacent memory and forces the operating system into an unexpected termination state. The condition manifests during the mount operation itself, before any user opens files inside the image.

Apple's advisory describes the fix as improved bounds checking, indicating that the vulnerable routine did not correctly validate the size or offset of input fields before writing to memory. The bug produces a denial-of-service outcome. The advisory does not indicate confidentiality or integrity impact, and there is no evidence that the flaw enables arbitrary code execution.

Root Cause

The root cause is an out-of-bounds write [CWE-787] in the disk image parser. Insufficient validation of length or offset fields in the crafted file allows a write operation to exceed the destination buffer. Apple's remediation added bounds checks to reject or safely handle malformed input.

Attack Vector

Exploitation requires an attacker to deliver a malicious disk image (for example, .dmg or similar) to a target user through email, a download, or a messaging service. The user must mount the image for the vulnerable code path to execute. Because macOS often auto-mounts downloaded disk images from browsers, the interaction requirement can be minimal. On iOS and iPadOS, delivery paths are more constrained but still viable through supported document handlers.

See the Apple Support Documentation #149034 and related advisories for full technical scope.

Detection Methods for CVE-2026-84519

Indicators of Compromise

Unexpected kernel panics or system restarts on Apple endpoints shortly after a disk image is mounted or auto-mounted from a downloaded file.
Presence of unfamiliar .dmg, .iso, or .sparseimage files in user Downloads folders originating from untrusted sources.
diskarbitrationd or hdiejectd crash reports in /Library/Logs/DiagnosticReports/ correlated with recent image mount events.

Detection Strategies

Correlate endpoint telemetry for hdiutil and diskimages-helper process executions with subsequent kernel panic or system termination events.
Alert on downloads of disk image file types from external senders followed by mount activity within a short time window.
Track file quarantine attributes (com.apple.quarantine) on newly created disk image files to identify attacker-delivered payloads.

Monitoring Recommendations

Aggregate crash and panic logs from managed Apple fleets into a centralized analytics platform to spot clusters of anomalous terminations.
Monitor MDM-reported OS versions to confirm all endpoints have moved to patched builds and flag stragglers.
Watch email and web gateways for .dmg and .iso attachments delivered from unverified sources.

How to Mitigate CVE-2026-84519

Immediate Actions Required

Upgrade impacted devices to iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 as applicable.
Instruct users not to mount disk images received from untrusted senders or downloaded from unverified websites.
Prioritize patching for developer, executive, and helpdesk endpoints where disk image handling is more frequent.

Patch Information

Apple has published fixes across five advisories covering the affected operating system families. Refer to Apple Support Documentation #149034, #149035, #149041, #149042, and #149043 for platform-specific build numbers and installation guidance.

Workarounds

Disable browser auto-mounting of downloaded disk images by unchecking Safari's "Open safe files after downloading" option.
Enforce MDM policies that block execution or mounting of disk image file types on managed endpoints where business need does not exist.
Route inbound .dmg and .iso attachments through a sandboxed analysis workflow before delivery to end users.

bash

# Disable Safari auto-open of downloaded files on macOS
defaults write com.apple.Safari AutoOpenSafeDownloads -bool false

# Verify installed macOS build against Apple's patched versions
sw_vers -productVersion
sw_vers -buildVersion