CVE-2026-84507

Apple · iOS, iPadOS, macOS, tvOS, visionOS, watchOS

A race condition in multiple Apple operating systems allows a local application to cause system termination or kernel memory corruption through improved state handling flaws.

Executive summary

A race condition vulnerability in multiple Apple platforms could allow a local malicious application to corrupt kernel memory or trigger an unexpected system termination.

Vulnerability

This is a race condition vulnerability, categorized as a memory corruption flaw, which occurs due to improper state handling. An attacker requires local access and low privileges to execute an application that triggers the flaw, potentially resulting in kernel-level memory corruption.

Business impact

Successful exploitation of this vulnerability can lead to a complete compromise of the local system integrity, as kernel memory corruption often serves as a prerequisite for privilege escalation or arbitrary code execution. While the CVSS score of 7.8 (High) reflects the requirement for local access, the potential for kernel-level impact poses a significant threat to data confidentiality and system stability. Organizations relying on these devices for sensitive operations face risks of unauthorized access and denial of service.

Remediation

Immediate Action: Update all affected Apple devices to the corresponding patched versions, specifically iOS/iPadOS 26.7 or 27, macOS 15.8, 26.7, or 27, and tvOS, visionOS, or watchOS 27.

Proactive Monitoring: Monitor system logs for repeated crash reports or unexpected kernel panics, which may indicate attempted exploitation of memory-related flaws.

Compensating Controls: Enforce strict mobile device management (MDM) policies to restrict the installation of untrusted or unauthorized applications, thereby limiting the attacker's ability to execute the malicious code required for exploitation.

Exploitation status

Public Exploit Available: No (exploit_available: false)

Analyst recommendation

Given the potential for kernel memory corruption, this vulnerability represents a significant security risk to Apple ecosystem users. IT administrators should prioritize the deployment of the provided firmware updates across all managed devices. Failure to patch may expose enterprise endpoints to sophisticated local attacks aimed at achieving elevated privileges or causing system-wide instability.

More Apple CVEs all →

History

CVE Brief tracked this CVE 3 days before it had a CVSS score.

  1. Disclosed CVE record published
  2. Collected by CVE Brief No CVSS score yet; tracked as early warning
  3. CVSS score assigned 7.8 (3.1)
  4. Analyst report written

Sources