Apple's iOS 27 and macOS Golden Gate 27 releases address a record number of security vulnerabilities, including approximately 126 flaws in iOS 27 (20 kernel-related) and 210 in macOS Golden Gate 27 (about 100 shared with iOS 27). The vulnerabilities affect over 90 platform components such as AppleKeyStore, Authentication Services, Foundation, Safe Browsing, Sandbox, Security, TCC, and WebKit. Notably, the updates fix kernel vulnerabilities that could cause memory corruption, privilege escalation, system termination, and information leaks. The macOS Tahoe 26.7 update also patches 153 CVEs including a medium-severity heap-based buffer overflow in Samba (CVE-2022-3437). Apple removed vulnerable code in CoreMedia related to CVE-2026-64752 instead of patching it. No evidence of exploitation in the wild has been reported. Additional updates for iOS 26.7, macOS Sequoia 15.8, tvOS 27, watchOS 27, visionOS 27, Safari 27, and Xcode 27 also include multiple security fixes.

The vulnerabilities patched in these updates could allow attackers to cause memory corruption, escalate privileges, terminate systems unexpectedly, or leak sensitive information. The kernel vulnerabilities are particularly critical as they affect core system security. The Samba heap-based buffer overflow could lead to denial-of-service conditions. However, there are no reports of these vulnerabilities being exploited in the wild at this time.

Apple has released official patches in iOS 27, macOS Golden Gate 27, and related updates that address these vulnerabilities. Users and organizations should apply these updates promptly to mitigate the risks. Since the vendor has provided official fixes, no additional mitigation steps are required beyond timely patching.