CVE-2026-84566: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-84566 Overview

CVE-2026-84566 is a memory corruption vulnerability affecting Apple iOS, iPadOS, and macOS. A local attacker with low privileges can trigger unexpected system termination or corrupt kernel memory. Apple addressed the issue with improved memory handling in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The flaw is categorized under [CWE-119], improper restriction of operations within the bounds of a memory buffer.

Critical Impact
Successful exploitation allows a local attacker to corrupt kernel memory or terminate the system, potentially enabling privilege escalation or persistent denial-of-service on Apple devices.

Affected Products

Apple iOS and iPadOS versions prior to 26.7 and 27
Apple macOS Sequoia prior to 15.8 and macOS Tahoe prior to 26.7
Apple macOS Golden Gate prior to 27

Discovery Timeline

2026-09-14 - CVE-2026-84566 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-84566

Vulnerability Analysis

CVE-2026-84566 is a kernel-level memory corruption issue affecting Apple's mobile and desktop operating systems. Apple's advisory states the flaw was resolved through improved memory handling, indicating the original code failed to safely manage buffer boundaries or object lifetimes in kernel-accessible paths. A local attacker running unprivileged code on the device can trigger the flaw to cause unexpected system termination or corrupt kernel memory structures.

Memory corruption in kernel space carries severe consequences. Corrupted kernel state can lead to arbitrary write primitives, allowing attackers to overwrite function pointers, credential structures, or page tables. Attackers frequently chain such flaws with sandbox escapes to achieve full device compromise on iOS and iPadOS.

Root Cause

The root cause maps to [CWE-119], improper restriction of operations within the bounds of a memory buffer. Apple has not published low-level technical details, but the fix description confirms improper memory handling in a kernel-reachable code path. The remediation strengthens bounds checking or object lifetime management to prevent the corruption condition.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker must execute code on the target device, typically through a malicious application or by compromising an existing process. Once running, the attacker invokes the vulnerable kernel interface with crafted inputs to trigger the memory corruption. See Apple Support Document #149034 for vendor details.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-84566

Indicators of Compromise

Unexpected kernel panics or system reboots recorded in device diagnostic logs
PanicFullLogs or panic-full-*.ips files in /Library/Logs/DiagnosticReports/ referencing corrupted kernel state
Installation of unsigned or side-loaded applications preceding system instability
Anomalous privilege escalation events on managed macOS endpoints

Detection Strategies

Collect and centralize crash and panic reports from macOS endpoints and MDM-enrolled iOS devices for correlation
Monitor endpoint telemetry for unsigned code execution or exploitation of local kernel interfaces
Baseline expected kernel panic frequency and alert on statistical deviations across the fleet

Monitoring Recommendations

Forward macOS ReportCrash and SubmitDiagInfo artifacts to a centralized log platform for retention and analysis
Track OS version compliance across the fleet and flag devices running versions prior to the fixed builds
Alert on repeated panics originating from the same process or bundle identifier

How to Mitigate CVE-2026-84566

Immediate Actions Required

Update all Apple devices to iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7
Enforce OS version compliance policies through your Mobile Device Management (MDM) platform
Restrict installation of untrusted applications and side-loaded profiles on managed devices
Audit local user accounts and remove unnecessary standard-user access on shared macOS systems

Patch Information

Apple released fixes across multiple product lines. Refer to the vendor advisories: Apple Support Document #149034, Apple Support Document #149035, Apple Support Document #149041, Apple Support Document #149042, and Apple Support Document #149043.

Workarounds

No official workaround exists; installing the vendor patch is the only complete remediation
Limit physical and remote local access to affected devices until patching is complete
Enable System Integrity Protection (SIP) and Gatekeeper on macOS to reduce the local attack surface

bash

# Verify macOS version meets the patched baseline
sw_vers -productVersion

# Trigger a software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart