Apple iOS, iPadOS, macOS: Use-after-free allows kernel code execution
Summary
A use-after-free vulnerability in Apple iOS, iPadOS and macOS allows an app to execute arbitrary code with kernel privileges. The attacker needs a local app running on the device with low privileges, and no user interaction is required. Apple has fixed the issue in the updates listed below, and no in-the-wild exploitation is known.
Affected
- iOS and iPadOS before 26.7 and before 27
- macOS before 15.8, before 26.7.2 and before 27
- Exact build numbers: Unknown.
Fixed in
- iOS 26.7 and iPadOS 26.7
- iOS 27 and iPadOS 27
- macOS Golden Gate 27
- macOS Sequoia 15.8
- macOS Tahoe 26.7.2
- iOS 26.7.2 is not listed as a fix for this CVE; use iOS 26.7 or later.
Workaround
Unknown. Apple documents only the software update as remediation.
Exploitation
- No evidence of in-the-wild exploitation.
- Not listed in CISA KEV.
- CNA SSVC data: exploitation none, automatable no.
- No public proof of concept found.
Our recommendation
- Install the fixed versions listed above on all iPhones, iPads and Macs, using MDM or inventory to verify patch levels.
- Restrict the installation of untrusted apps on managed devices.
- Monitor for changes to KEV status and check the full Apple advisory for the affected component.
- Prioritise shared devices and fleets where users install apps freely.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apple: About the security content of iOS 27 and iPadOS 27 support.apple.com
- Apple: About the security content of macOS Golden Gate 27 support.apple.com
- Apple: iOS 26.7 security content support.apple.com
- Apple: macOS Tahoe 26.7.2 security content support.apple.com
- OpenCVE: CVE-2026-86916 app.opencve.io
- Strix: CVE-2026-86916 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:14.
Original description (NVD)
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7.2. An app may be able to execute arbitrary code with kernel privileges.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.