CVE-2026-84561: Apple iPadOS Use-After-Free Vulnerability

CVE-2026-84561 Overview

CVE-2026-84561 is a double free vulnerability [CWE-415] affecting a wide range of Apple operating systems. The flaw allows a malicious application to trigger unexpected system termination or corrupt kernel memory. Apple addressed the issue with improved memory management across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The vulnerability carries a network attack vector according to its published CVSS metrics, meaning the impact extends beyond local-only exploitation scenarios.

Critical Impact
A crafted application can corrupt kernel memory, potentially leading to system compromise or arbitrary code execution in a privileged context.

Affected Products

Apple iOS and iPadOS (fixed in iOS 26.7 / iPadOS 26.7 and iOS 27 / iPadOS 27)
Apple macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27
Apple tvOS 27, visionOS 27, and watchOS 27

Discovery Timeline

2026-09-14 - CVE CVE-2026-84561 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84561

Vulnerability Analysis

The issue is a double free condition in an Apple operating system component shared across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. A double free occurs when the same memory region is released twice through calls to a deallocation routine such as free(). The second release corrupts allocator metadata and can leave dangling references inside kernel data structures.

According to Apple's advisories, an application on the affected system can trigger unexpected termination or corrupt kernel memory. Kernel memory corruption of this class often forms the basis for privilege escalation chains, where attackers pair the primitive with an information disclosure bug to achieve reliable code execution.

Apple resolved the issue with improved memory management, which typically involves clearing pointers after free, tightening reference counting, or restructuring ownership of the affected object.

Root Cause

The root cause is improper tracking of ownership of a heap-allocated object. When two code paths both assume responsibility for releasing the same allocation, the allocator processes two free operations against a single pointer. This corrupts allocator freelists and enables attacker-controlled overwrites of adjacent metadata.

Attack Vector

Apple describes the entry point as "an app," indicating that the attacker must run code on the device. The published CVSS vector lists a network attack vector with no privileges or user interaction required, which reflects the severity if the primitive is reachable through a network-facing service or sandboxed content processor. Apple has not published exploit prerequisites beyond the general application-level description.

No public proof-of-concept code, exploit modules, or CISA KEV entries are associated with this CVE at the time of publication. See the Apple security advisories for component-specific technical details.

Detection Methods for CVE-2026-84561

Indicators of Compromise

Unexpected kernel panics or system reboots on Apple endpoints, particularly correlated with the launch of a specific third-party application.
Crash reports referencing memory allocator assertions, freelist corruption, or zone_require failures.
Newly installed or sideloaded applications on managed devices immediately preceding stability incidents.

Detection Strategies

Collect and centralize macOS and iOS crash logs, then hunt for repeated kernel panics that share a common process ancestor.
Track OS build versions across the fleet with mobile device management (MDM) reporting to identify endpoints still running pre-patch versions.
Alert on application installations from unmanaged sources on devices lacking the fixed OS build.

Monitoring Recommendations

Use MDM compliance policies to flag devices below iOS 26.7, iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.7, or their version-27 successors.
Forward endpoint telemetry and crash artifacts to a centralized data lake for correlation across users, devices, and application inventories.
Monitor Apple's security advisory feed for updates or supplementary fixes affecting the same component.

How to Mitigate CVE-2026-84561

Immediate Actions Required

Deploy the fixed OS versions across all affected Apple devices as soon as the update passes internal validation.
Prioritize devices that install applications from outside the App Store or that run third-party frameworks with elevated entitlements.
Audit installed applications on high-value devices and remove untrusted software until patches are applied.

Patch Information

Apple has released fixes in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. Refer to the vendor advisories: Apple Support 149034, 149035, 149036, 149037, 149038, 149041, 149042, and 149043.

Workarounds

No vendor-provided workaround exists; patching is the only supported remediation.
Restrict installation of untrusted applications through MDM configuration profiles until updates are deployed.
Enforce Lockdown Mode on high-risk user devices to reduce the attack surface exposed to malicious content.

bash

# Example: query macOS build version to identify unpatched endpoints
sw_vers -productVersion

# Example: query iOS build version via MDM query key
# DeviceInformation query key: "OSVersion"