CVE-2026-86913: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory in Apple iOS and iPadOS

This vulnerability involves a use-after-free condition triggered by processing specially crafted media files on Apple platforms including iOS and iPadOS. Exploitation can lead to unexpected app crashes or memory corruption, potentially impacting system stability or security. Apple has fixed the issue by improving memory management in the affected operating systems and versions. No CVSS score is provided, and no known exploits are reported in the wild at this time.

Successful exploitation may cause applications to terminate unexpectedly or corrupt process memory, which could lead to denial of service or potentially other memory corruption consequences. The impact is limited to affected Apple operating systems prior to the fixed versions.

Apple has released official fixes for this vulnerability in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. Users and administrators should apply these updates to remediate the issue. No additional mitigation is indicated by the vendor advisory.