Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
1 vulnerability found for visionOS 27 by unknown
GCVE-1988-2026-0398
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
APPLE-SA-09-14-2026-8 visionOS 27
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-8 visionOS 27
visionOS 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149038.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may lead to unexpected
process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86882: Peter Malone
APFS
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher
App Store
Available for: Apple Vision Pro (all models)
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86888: Zhongcheng Li (CK01)
Apple Account
Available for: Apple Vision Pro (all models)
Impact: An app may be able to use the Sign In With Apple authentication
flow to access the user's Apple Account
Description: An authentication issue was addressed with improved state
management.
CVE-2026-20683: Dem0ns (@天府简易信工作室), Abdelhak Kherroubi, Jasminder Pal
Singh, Lehan Dilusha Jayasingha (Sri Lanka)
AppleAVD
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
Audio
Available for: Apple Vision Pro (all models)
Impact: An app may be able to leak sensitive user information
Description: A logic issue was addressed with improved checks.
CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik
Tsytsarkin
Authentication Services
Available for: Apple Vision Pro (all models)
Impact: An app may be able to delete credentials stored in Keychain
Description: This issue was addressed by removing the vulnerable code.
CVE-2026-86905: Ilya Andr (andrd3v)
AuthKit
Available for: Apple Vision Pro (all models)
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-84583: Zhongcheng Li from IES Red Team
AVEVideoEncoder
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved checks.
CVE-2026-65410: Calif.io in collaboration with Claude and Anthropic
Research
AVEVideoEncoder
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-84616: Peter Malone
AVEVideoEncoder
Available for: Apple Vision Pro (all models)
Impact: A sandboxed app may be able to execute arbitrary code with
kernel privileges
Description: A race condition was addressed with improved state
management.
CVE-2026-84607: Ruslan Dautov
BackgroundAssets
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved validation.
CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security
Bluetooth
Available for: Apple Vision Pro (all models)
Impact: A remote attacker may be able to cause unexpected app
termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65414
Bluetooth
Available for: Apple Vision Pro (all models)
Impact: An app may gain unauthorized access to Bluetooth
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84560: an anonymous researcher
CloudKit
Available for: Apple Vision Pro (all models)
Impact: A local app may be able to read a persistent account identifier
Description: An information disclosure issue was addressed with improved
state management.
CVE-2026-86895: Stanislav Jelezoglo
CloudKit
Available for: Apple Vision Pro (all models)
Impact: An app may be able to read device name
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-86893: Heiner Gerdes
copyfile
Available for: Apple Vision Pro (all models)
Impact: An archive may be able to bypass Gatekeeper
Description: A file quarantine bypass was addressed with additional
checks.
CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,
an anonymous researcher
CoreMedia
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A memory corruption issue was addressed by removing the
vulnerable code.
CVE-2026-64752: Nik Tsytsarkin
CoreMedia
Available for: Apple Vision Pro (all models)
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86876: Chris Bailey - Short Circuit
CoreMedia
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65344: Siyeong kim
CoreML
Available for: Apple Vision Pro (all models)
Impact: A sandboxed app may be able to access restricted files
Description: A permissions issue was addressed with improved path
validation.
CVE-2026-84624: AL Najafi, tamdao
CoreText
Available for: Apple Vision Pro (all models)
Impact: Processing web content may lead to a denial-of-service
Description: A null pointer dereference was addressed with improved
input validation.
CVE-2026-65412: Pavan Nallamothu
CoreText
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84596: ret2happy, Meta Product Security
CoreUI
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)
CoreUI
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may lead to unexpected
app termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-84571: stratan (@5tratan), Peter Malone
CoreUI
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted asset catalog may lead to
unexpected process termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-84511: Rahul Raj, stratan (@5tratan)
DeviceCheck
Available for: Apple Vision Pro (all models)
Impact: An app may be able to read persistent device identifiers
Description: An authorization issue was addressed with improved access
control.
CVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill
(@jjtech@infosec.exchange)
File Bookmark
Available for: Apple Vision Pro (all models)
Impact: An app may be able to modify a file it only had permission to
read
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya
Kumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)
file_cmds
Available for: Apple Vision Pro (all models)
Impact: Extracting a maliciously crafted archive may allow an attacker
to write arbitrary files
Description: A path handling issue was addressed with improved
validation.
CVE-2026-84534: Geoffrey Lovelace
FontParser
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted font file may lead to
unexpected app termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-84524: an anonymous researcher
FontParser
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read issue was addressed with improved
input validation.
CVE-2026-84597: Nik Tsytsarkin
Foundation
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause a denial of service
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and
Anthropic Research
Graphics
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),
Jiyong Yang
iCloud
Available for: Apple Vision Pro (all models)
Impact: An app may be able to identify a user across reinstalls
Description: A privacy issue was addressed with improved handling of
identifiers.
CVE-2026-84606: Ilya Andr (andrd3v)
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may result in disclosure
of process memory
Description: An uninitialized memory issue was addressed with improved
memory initialization.
CVE-2026-84564: Justin O'Leary
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing an image may lead to a denial-of-service
Description: The issue was addressed with improved checks.
CVE-2026-65347: Geonha Lee (@leegn4a)
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing an image may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-65346: Meta Red Team X - Nik Tsytsarkin
ImageIO
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may result in memory
corruption
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan
IOGPUFamily
Available for: Apple Vision Pro (all models)
Impact: Processing maliciously crafted web content may lead to memory
corruption
Description: The issue was addressed with improved memory handling.
CVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and
3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi
IOKit
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, 이재영
IOMobileFrameBuffer
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds access issue was addressed with improved
bounds checking.
CVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,
dbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin
CVE-2026-64736: Ruslan Dautov, hxr1
IOSurfaceAccelerator
Available for: Apple Vision Pro (all models)
Impact: An app may be able to leak sensitive kernel state
Description: An information leakage was addressed with additional
validation.
CVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),
Franco Belman at Blackwing Intelligence
Kernel
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-28968: genter0, Svetoslav Stolarov & Aisa Fox, Josh Maine of
Calif.io, Dun
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | visionOS 27 |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0398 (this record)
- related CVE-2026-20683
- related CVE-2026-28935
- related CVE-2026-28966
- related CVE-2026-28968
- related CVE-2026-28969
- related CVE-2026-43686
- related CVE-2026-43687
- related CVE-2026-43689
- related CVE-2026-43695
- related CVE-2026-43785
- related CVE-2026-43794
- related CVE-2026-43795
- related CVE-2026-64715
- related CVE-2026-64718
- related CVE-2026-64736
- related CVE-2026-64752
- related CVE-2026-64753
- related CVE-2026-64760
- related CVE-2026-64778
- related CVE-2026-64779
- related CVE-2026-64780
- related CVE-2026-64781
- related CVE-2026-64782
- related CVE-2026-64784
- related CVE-2026-64787
- related CVE-2026-64788
- related CVE-2026-65330
- related CVE-2026-65331
- related CVE-2026-65332
- related CVE-2026-65333
- related CVE-2026-65334
- related CVE-2026-65335
- related CVE-2026-65336
- related CVE-2026-65337
- related CVE-2026-65338
- related CVE-2026-65339
- related CVE-2026-65340
- related CVE-2026-65341
- related CVE-2026-65343
- related CVE-2026-65344
- related CVE-2026-65346
- related CVE-2026-65347
- related CVE-2026-65349
- related CVE-2026-65351
- related CVE-2026-65358
- related CVE-2026-65359
- related CVE-2026-65360
- related CVE-2026-65377
- related CVE-2026-65390
- related CVE-2026-65391
- related CVE-2026-65395
- related CVE-2026-65398
- related CVE-2026-65399
- related CVE-2026-65402
- related CVE-2026-65403
- related CVE-2026-65405
- related CVE-2026-65406
- related CVE-2026-65407
- related CVE-2026-65409
- related CVE-2026-65410
- related CVE-2026-65411
- related CVE-2026-65412
- related CVE-2026-65414
- related CVE-2026-65415
- related CVE-2026-84487
- related CVE-2026-84491
- related CVE-2026-84492
- related CVE-2026-84497
- related CVE-2026-84507
- related CVE-2026-84511
- related CVE-2026-84513
- related CVE-2026-84521
- related CVE-2026-84523
- related CVE-2026-84524
- related CVE-2026-84526
- related CVE-2026-84527
- related CVE-2026-84530
- related CVE-2026-84532
- related CVE-2026-84534
- related CVE-2026-84546
- related CVE-2026-84551
- related CVE-2026-84560
- related CVE-2026-84561
- related CVE-2026-84564
- related CVE-2026-84571
- related CVE-2026-84575
- related CVE-2026-84583
- related CVE-2026-84596
- related CVE-2026-84597
- related CVE-2026-84600
- related CVE-2026-84602
- related CVE-2026-84603
- related CVE-2026-84606
- related CVE-2026-84607
- related CVE-2026-84609
- related CVE-2026-84611
- related CVE-2026-84612
- related CVE-2026-84615
- related CVE-2026-84616
- related CVE-2026-84620
- related CVE-2026-84622
- related CVE-2026-84624
- related CVE-2026-84625
- related CVE-2026-84626
- related CVE-2026-84628
- related CVE-2026-84629
- related CVE-2026-84630
- related CVE-2026-84632
- related CVE-2026-84635
- related CVE-2026-84636
- related CVE-2026-86870
- related CVE-2026-86876
- related CVE-2026-86881
- related CVE-2026-86882
- related CVE-2026-86883
- related CVE-2026-86887
- related CVE-2026-86888
- related CVE-2026-86892
- related CVE-2026-86893
- related CVE-2026-86895
- related CVE-2026-86897
- related CVE-2026-86898
- related CVE-2026-86903
- related CVE-2026-86905
{
"containers": {
"cna": {
"affected": [
{
"product": "visionOS 27",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-8 visionOS 27\n\nvisionOS 27 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149038.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAPFS\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nApp Store\nAvailable for: Apple Vision Pro (all models)\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86888: Zhongcheng Li (CK01)\n\nApple Account\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to use the Sign In With Apple authentication\nflow to access the user\u0027s Apple Account\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-20683: Dem0ns (@\u5929\u5e9c\u7b80\u6613\u4fe1\u5de5\u4f5c\u5ba4), Abdelhak Kherroubi, Jasminder Pal\nSingh, Lehan Dilusha Jayasingha (Sri Lanka)\n\nAppleAVD\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik\nTsytsarkin\n\nAuthentication Services\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to delete credentials stored in Keychain\nDescription: This issue was addressed by removing the vulnerable code.\nCVE-2026-86905: Ilya Andr (andrd3v)\n\nAuthKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nAVEVideoEncoder\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: The issue was addressed with improved checks.\nCVE-2026-65410: Calif.io in collaboration with Claude and Anthropic\nResearch\n\nAVEVideoEncoder\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-84616: Peter Malone\n\nAVEVideoEncoder\nAvailable for: Apple Vision Pro (all models)\nImpact: A sandboxed app may be able to execute arbitrary code with\nkernel privileges\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84607: Ruslan Dautov\n\nBackgroundAssets\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A logic issue was addressed with improved validation.\nCVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security\n\nBluetooth\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause unexpected app\ntermination or arbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65414\n\nBluetooth\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may gain unauthorized access to Bluetooth\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-84560: an anonymous researcher\n\nCloudKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A local app may be able to read a persistent account identifier\nDescription: An information disclosure issue was addressed with improved\nstate management.\nCVE-2026-86895: Stanislav Jelezoglo\n\nCloudKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to read device name\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86893: Heiner Gerdes\n\ncopyfile\nAvailable for: Apple Vision Pro (all models)\nImpact: An archive may be able to bypass Gatekeeper\nDescription: A file quarantine bypass was addressed with additional\nchecks.\nCVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola,\nan anonymous researcher\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: A memory corruption issue was addressed by removing the\nvulnerable code.\nCVE-2026-64752: Nik Tsytsarkin\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: A sandboxed process may be able to circumvent sandbox\nrestrictions\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86876: Chris Bailey - Short Circuit\n\nCoreMedia\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65344: Siyeong kim\n\nCoreML\nAvailable for: Apple Vision Pro (all models)\nImpact: A sandboxed app may be able to access restricted files\nDescription: A permissions issue was addressed with improved path\nvalidation.\nCVE-2026-84624: AL Najafi, tamdao\n\nCoreText\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing web content may lead to a denial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-65412: Pavan Nallamothu\n\nCoreText\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84596: ret2happy, Meta Product Security\n\nCoreUI\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)\n\nCoreUI\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to unexpected\napp termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-84571: stratan (@5tratan), Peter Malone\n\nCoreUI\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted asset catalog may lead to\nunexpected process termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84511: Rahul Raj, stratan (@5tratan)\n\nDeviceCheck\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to read persistent device identifiers\nDescription: An authorization issue was addressed with improved access\ncontrol.\nCVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill\n(@jjtech@infosec.exchange)\n\nFile Bookmark\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to modify a file it only had permission to\nread\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya\nKumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)\n\nfile_cmds\nAvailable for: Apple Vision Pro (all models)\nImpact: Extracting a maliciously crafted archive may allow an attacker\nto write arbitrary files\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-84534: Geoffrey Lovelace\n\nFontParser\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted font file may lead to\nunexpected app termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-84524: an anonymous researcher\n\nFontParser\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read issue was addressed with improved\ninput validation.\nCVE-2026-84597: Nik Tsytsarkin\n\nFoundation\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and\nAnthropic Research\n\nGraphics\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg),\nJiyong Yang\n\niCloud\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to identify a user across reinstalls\nDescription: A privacy issue was addressed with improved handling of\nidentifiers.\nCVE-2026-84606: Ilya Andr (andrd3v)\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may result in disclosure\nof process memory\nDescription: An uninitialized memory issue was addressed with improved\nmemory initialization.\nCVE-2026-84564: Justin O\u0027Leary\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may result in memory\ncorruption\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan\n\nIOGPUFamily\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64788: an anonymous researcher, f00l (@PPPF00L) and\n3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and \u4e91\u6563\u82b1\u6298, Arjanit Isufi\n\nIOKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, \uc774\uc7ac\uc601\n\nIOMobileFrameBuffer\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0,\ndbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin\nCVE-2026-64736: Ruslan Dautov, hxr1\n\nIOSurfaceAccelerator\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to leak sensitive kernel state\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher),\nFranco Belman at Blackwing Intelligence\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-28968: genter0, Svetoslav Stolarov \u0026 Aisa Fox, Josh Maine of\nCalif.io, Dun\n"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:32Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/60"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/60"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/149038"
},
{
"url": "https://support.apple.com/kb/HT214009"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/60"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-09-14-2026-8 visionOS 27",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-20683",
"type": "related"
},
{
"destId": "CVE-2026-28935",
"type": "related"
},
{
"destId": "CVE-2026-28966",
"type": "related"
},
{
"destId": "CVE-2026-28968",
"type": "related"
},
{
"destId": "CVE-2026-28969",
"type": "related"
},
{
"destId": "CVE-2026-43686",
"type": "related"
},
{
"destId": "CVE-2026-43687",
"type": "related"
},
{
"destId": "CVE-2026-43689",
"type": "related"
},
{
"destId": "CVE-2026-43695",
"type": "related"
},
{
"destId": "CVE-2026-43785",
"type": "related"
},
{
"destId": "CVE-2026-43794",
"type": "related"
},
{
"destId": "CVE-2026-43795",
"type": "related"
},
{
"destId": "CVE-2026-64715",
"type": "related"
},
{
"destId": "CVE-2026-64718",
"type": "related"
},
{
"destId": "CVE-2026-64736",
"type": "related"
},
{
"destId": "CVE-2026-64752",
"type": "related"
},
{
"destId": "CVE-2026-64753",
"type": "related"
},
{
"destId": "CVE-2026-64760",
"type": "related"
},
{
"destId": "CVE-2026-64778",
"type": "related"
},
{
"destId": "CVE-2026-64779",
"type": "related"
},
{
"destId": "CVE-2026-64780",
"type": "related"
},
{
"destId": "CVE-2026-64781",
"type": "related"
},
{
"destId": "CVE-2026-64782",
"type": "related"
},
{
"destId": "CVE-2026-64784",
"type": "related"
},
{
"destId": "CVE-2026-64787",
"type": "related"
},
{
"destId": "CVE-2026-64788",
"type": "related"
},
{
"destId": "CVE-2026-65330",
"type": "related"
},
{
"destId": "CVE-2026-65331",
"type": "related"
},
{
"destId": "CVE-2026-65332",
"type": "related"
},
{
"destId": "CVE-2026-65333",
"type": "related"
},
{
"destId": "CVE-2026-65334",
"type": "related"
},
{
"destId": "CVE-2026-65335",
"type": "related"
},
{
"destId": "CVE-2026-65336",
"type": "related"
},
{
"destId": "CVE-2026-65337",
"type": "related"
},
{
"destId": "CVE-2026-65338",
"type": "related"
},
{
"destId": "CVE-2026-65339",
"type": "related"
},
{
"destId": "CVE-2026-65340",
"type": "related"
},
{
"destId": "CVE-2026-65341",
"type": "related"
},
{
"destId": "CVE-2026-65343",
"type": "related"
},
{
"destId": "CVE-2026-65344",
"type": "related"
},
{
"destId": "CVE-2026-65346",
"type": "related"
},
{
"destId": "CVE-2026-65347",
"type": "related"
},
{
"destId": "CVE-2026-65349",
"type": "related"
},
{
"destId": "CVE-2026-65351",
"type": "related"
},
{
"destId": "CVE-2026-65358",
"type": "related"
},
{
"destId": "CVE-2026-65359",
"type": "related"
},
{
"destId": "CVE-2026-65360",
"type": "related"
},
{
"destId": "CVE-2026-65377",
"type": "related"
},
{
"destId": "CVE-2026-65390",
"type": "related"
},
{
"destId": "CVE-2026-65391",
"type": "related"
},
{
"destId": "CVE-2026-65395",
"type": "related"
},
{
"destId": "CVE-2026-65398",
"type": "related"
},
{
"destId": "CVE-2026-65399",
"type": "related"
},
{
"destId": "CVE-2026-65402",
"type": "related"
},
{
"destId": "CVE-2026-65403",
"type": "related"
},
{
"destId": "CVE-2026-65405",
"type": "related"
},
{
"destId": "CVE-2026-65406",
"type": "related"
},
{
"destId": "CVE-2026-65407",
"type": "related"
},
{
"destId": "CVE-2026-65409",
"type": "related"
},
{
"destId": "CVE-2026-65410",
"type": "related"
},
{
"destId": "CVE-2026-65411",
"type": "related"
},
{
"destId": "CVE-2026-65412",
"type": "related"
},
{
"destId": "CVE-2026-65414",
"type": "related"
},
{
"destId": "CVE-2026-65415",
"type": "related"
},
{
"destId": "CVE-2026-84487",
"type": "related"
},
{
"destId": "CVE-2026-84491",
"type": "related"
},
{
"destId": "CVE-2026-84492",
"type": "related"
},
{
"destId": "CVE-2026-84497",
"type": "related"
},
{
"destId": "CVE-2026-84507",
"type": "related"
},
{
"destId": "CVE-2026-84511",
"type": "related"
},
{
"destId": "CVE-2026-84513",
"type": "related"
},
{
"destId": "CVE-2026-84521",
"type": "related"
},
{
"destId": "CVE-2026-84523",
"type": "related"
},
{
"destId": "CVE-2026-84524",
"type": "related"
},
{
"destId": "CVE-2026-84526",
"type": "related"
},
{
"destId": "CVE-2026-84527",
"type": "related"
},
{
"destId": "CVE-2026-84530",
"type": "related"
},
{
"destId": "CVE-2026-84532",
"type": "related"
},
{
"destId": "CVE-2026-84534",
"type": "related"
},
{
"destId": "CVE-2026-84546",
"type": "related"
},
{
"destId": "CVE-2026-84551",
"type": "related"
},
{
"destId": "CVE-2026-84560",
"type": "related"
},
{
"destId": "CVE-2026-84561",
"type": "related"
},
{
"destId": "CVE-2026-84564",
"type": "related"
},
{
"destId": "CVE-2026-84571",
"type": "related"
},
{
"destId": "CVE-2026-84575",
"type": "related"
},
{
"destId": "CVE-2026-84583",
"type": "related"
},
{
"destId": "CVE-2026-84596",
"type": "related"
},
{
"destId": "CVE-2026-84597",
"type": "related"
},
{
"destId": "CVE-2026-84600",
"type": "related"
},
{
"destId": "CVE-2026-84602",
"type": "related"
},
{
"destId": "CVE-2026-84603",
"type": "related"
},
{
"destId": "CVE-2026-84606",
"type": "related"
},
{
"destId": "CVE-2026-84607",
"type": "related"
},
{
"destId": "CVE-2026-84609",
"type": "related"
},
{
"destId": "CVE-2026-84611",
"type": "related"
},
{
"destId": "CVE-2026-84612",
"type": "related"
},
{
"destId": "CVE-2026-84615",
"type": "related"
},
{
"destId": "CVE-2026-84616",
"type": "related"
},
{
"destId": "CVE-2026-84620",
"type": "related"
},
{
"destId": "CVE-2026-84622",
"type": "related"
},
{
"destId": "CVE-2026-84624",
"type": "related"
},
{
"destId": "CVE-2026-84625",
"type": "related"
},
{
"destId": "CVE-2026-84626",
"type": "related"
},
{
"destId": "CVE-2026-84628",
"type": "related"
},
{
"destId": "CVE-2026-84629",
"type": "related"
},
{
"destId": "CVE-2026-84630",
"type": "related"
},
{
"destId": "CVE-2026-84632",
"type": "related"
},
{
"destId": "CVE-2026-84635",
"type": "related"
},
{
"destId": "CVE-2026-84636",
"type": "related"
},
{
"destId": "CVE-2026-86870",
"type": "related"
},
{
"destId": "CVE-2026-86876",
"type": "related"
},
{
"destId": "CVE-2026-86881",
"type": "related"
},
{
"destId": "CVE-2026-86882",
"type": "related"
},
{
"destId": "CVE-2026-86883",
"type": "related"
},
{
"destId": "CVE-2026-86887",
"type": "related"
},
{
"destId": "CVE-2026-86888",
"type": "related"
},
{
"destId": "CVE-2026-86892",
"type": "related"
},
{
"destId": "CVE-2026-86893",
"type": "related"
},
{
"destId": "CVE-2026-86895",
"type": "related"
},
{
"destId": "CVE-2026-86897",
"type": "related"
},
{
"destId": "CVE-2026-86898",
"type": "related"
},
{
"destId": "CVE-2026-86903",
"type": "related"
},
{
"destId": "CVE-2026-86905",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0398",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/60",
"automated": true,
"contentSha256": "d1a72a0a042e783ac09829d6e2610d4e6db9aa438ec5ede9027011353dc55579",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/60",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-14T22:09:24Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0398"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:32Z",
"dateUpdated": "2026-10-02T04:57:32Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0398"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}