CVE-2026-84531: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-84531 Overview

CVE-2026-84531 is an out-of-bounds write vulnerability [CWE-787] affecting Apple iOS, iPadOS, and macOS. The flaw resides in the operating system's handling of NT LAN Manager (NTLM) input. Processing maliciously crafted NTLM data may lead to unexpected application termination. Apple addressed the issue with improved bounds checking in iOS 27, iPadOS 27, and macOS Golden Gate 27. The vulnerability requires local access and does not require user interaction or elevated privileges to trigger.

Critical Impact
Attackers with local access can trigger memory corruption by supplying crafted NTLM input, resulting in application termination and potential denial of service on affected Apple platforms.

Affected Products

Apple iOS (versions prior to iOS 27)
Apple iPadOS (versions prior to iPadOS 27)
Apple macOS (versions prior to macOS Golden Gate 27)

Discovery Timeline

2026-09-14 - CVE-2026-84531 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-84531

Vulnerability Analysis

The vulnerability is an out-of-bounds write condition [CWE-787] in the NTLM processing component shared across Apple's operating systems. NTLM is a suite of Microsoft authentication protocols still supported for compatibility with Windows environments. When the affected component parses NTLM messages, insufficient bounds validation allows a crafted input to write data beyond the intended memory buffer.

The write occurs within a locally reachable code path, meaning an attacker must be able to deliver the malformed NTLM input to a process on the target device. Successful exploitation causes unexpected app termination, resulting in a denial-of-service condition. Apple's advisory does not indicate arbitrary code execution as an outcome. The impact is limited to availability, with confidentiality and integrity unaffected according to the published metrics.

Root Cause

The root cause is missing or incorrect boundary checks in the routine that parses NTLM protocol structures. When an NTLM message contains field length values or offsets that exceed the allocated buffer, the parser writes past the buffer boundary. Apple documented the remediation as improved bounds checking, confirming the defect is a validation gap in input-length handling rather than a logic error in the authentication flow.

Attack Vector

Exploitation requires local access to the vulnerable device. An attacker supplies a malformed NTLM message to a process that invokes the vulnerable NTLM parsing routine. This may occur through a local application, an intermediary service, or content that triggers NTLM processing. No authentication or user interaction is required. The primary observed effect is process termination, which can be used to disrupt security-relevant services or cause repeated application crashes.

No verified public exploit code is available for CVE-2026-84531. See the Apple Support Article #149034 and Apple Support Article #149035 for vendor technical details.

Detection Methods for CVE-2026-84531

Indicators of Compromise

Repeated unexpected crashes of processes that handle NTLM authentication traffic on iOS, iPadOS, or macOS devices.
Crash reports in ~/Library/Logs/DiagnosticReports/ (macOS) referencing NTLM-related stack frames or memory access faults.
Unusual local processes generating malformed NTLM messages against system services.

Detection Strategies

Monitor macOS unified logs and iOS crash telemetry for recurring termination events tied to NTLM parsing components.
Correlate crash signatures with process ancestry to identify local applications repeatedly triggering the affected code path.
Track OS build versions across the fleet to identify endpoints still running pre-iOS 27, pre-iPadOS 27, or pre-macOS Golden Gate 27 releases.

Monitoring Recommendations

Ingest macOS endpoint crash and diagnostic logs into a centralized analytics platform for pattern analysis.
Alert on abnormal frequency of process terminations for services that consume NTLM input.
Maintain an inventory of Apple device OS versions and flag hosts not upgraded to the patched builds.

How to Mitigate CVE-2026-84531

Immediate Actions Required

Update all affected Apple devices to iOS 27, iPadOS 27, or macOS Golden Gate 27 or later.
Prioritize patching endpoints used in environments that regularly process NTLM authentication traffic.
Review installed applications that invoke NTLM authentication and confirm they operate correctly after the update.

Patch Information

Apple addressed CVE-2026-84531 by adding improved bounds checking in the NTLM parser. The fix is included in iOS 27, iPadOS 27, and macOS Golden Gate 27. Refer to Apple Support Article #149034 and Apple Support Article #149035 for the complete list of security content and installation instructions.

Workarounds

No vendor-supplied workaround exists; applying the security update is the only supported remediation.
Restrict local access to affected devices where feasible until the patch is deployed.
Limit exposure of services that process NTLM input to untrusted local processes.

bash

# Verify the installed macOS build to confirm the patch is applied
sw_vers

# On managed fleets, query device OS version via MDM to identify unpatched endpoints
# Example: filter for devices below macOS Golden Gate 27