Apple iOS and macOS: Stack-based buffer overflow in Bluetooth component
Summary
A stack-based buffer overflow in an Apple component (Bluetooth stack) affects iOS, iPadOS, macOS and visionOS. An attacker who holds a paired Bluetooth device may be able to execute arbitrary code. The attack requires proximity and a paired device, so it is not a remote internet threat. Apple has fixed the issue in the listed releases.
Affected
- iOS and iPadOS before 26.7, and 27 before 27
- macOS before 15.8, before 26.7, and before 27 (per affected version ranges in the CVE record)
- visionOS before 27
Fixed in
- iOS 26.7 and iPadOS 26.7
- iOS 27 and iPadOS 27
- macOS Golden Gate 27
- macOS Sequoia 15.8
- macOS Tahoe 26.7
- visionOS 27
Workaround
Unknown. No vendor workaround is listed in the sources. Until devices are updated, limit Bluetooth pairings to known devices and remove unused pairings (own suggestion, not a vendor recommendation).
Exploitation
- No public exploitation known.
- CISA SSVC data: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory all Apple devices (iPhone, iPad, Mac, Vision Pro).
- Update to the fixed versions listed above or newer, ideally via MDM.
- Remove stale Bluetooth pairings and restrict unknown accessories where MDM allows it.
- Recheck Apple's security advisories after release, as the CVE entry may change.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apple security content of iOS 27 and iPadOS 27 support.apple.com
- Apple security content of macOS Golden Gate 27 support.apple.com
- Apple security content (advisory 149038) support.apple.com
- Apple security content (advisory 149041, iOS 26.7) support.apple.com
- Apple security content (advisory 149042) support.apple.com
- Apple security content (advisory 149043) support.apple.com
- OpenCVE entry CVE-2026-86919 app.opencve.io
- VulDB entry 422624 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:38.
Original description (NVD)
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.