CVE-2026-86869
Apple ImageIO EXR out-of-bounds write (zero-click claim by researcher)
Apple fixed CVE-2026-86869, an out-of-bounds write in ImageIO's EXR handling, on 14 September 2026. Apple's own text says a crafted image may cause unexpected app termination. Researcher ironPeak says it was zero-click via iMessage, but did not show full code execution. Not in CISA KEV.
By ThreatWire Desk · Published 14 Sept 2026 · Updated 17 Oct 2026
- CVSS
- 6.5
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Class
- Other
- Status
- No PoC
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Apple
- Products
- iOS, iPadOS, macOS
- Affected
- iOS and iPadOS before 26.7. macOS before Golden Gate 27. Apple's CVE record lists no other affected branches.
- Fixed
- iOS 26.7, iPadOS 26.7 and macOS Golden Gate 27, all released 14 September 2026.
- CWE
- CWE-787
- Published
- 14 Sept 2026
- Updated
- 17 Oct 2026
No public PoC is confirmed on this record.
CVE-2026-86869 is an out-of-bounds write (CWE-787) in Apple's ImageIO framework. Apple fixed it on 14 September 2026.
Apple's wording is short. It says processing a maliciously crafted image may lead to unexpected app termination. The fix is "improved bounds checking".
Fixed versions are iOS 26.7, iPadOS 26.7 and macOS Golden Gate 27. Earlier builds are affected.
The score is CVSS 3.1 6.5 (Medium). It is listed by NVD from a secondary source, not by Apple. Apple does not publish a score.
Apple credits Niels Hofmans, Meta Red Team X, Geonha Lee (@leegn4a) and Chris Bailey of Short Circuit. TechCrunch ties Hofmans to ironPeak.
ironPeak's write-up goes further than Apple. It says the bug sits in the EXR decoder (libAppleEXR) and can be reached by an iMessage attachment with no tap. It says the decode runs outside BlastDoor, in a background photo-library process.
ironPeak says the zero-click trigger was confirmed on a real iPad. It says the write was steered to a controlled value in a test setup. It also says the last step was blocked by pointer authentication, and that memory tagging on newest chips stopped it. Full remote code execution was not shown.
ThreatWire could not confirm the zero-click and BlastDoor claims from Apple. Those come from the researcher. The write-up has no public exploit file, so the PoC field is set to none.
The CVE is not in the CISA KEV catalog. CISA's SSVC entry says exploitation: none. No attacks are reported.
What to do: update iPhones and iPads to iOS or iPadOS 26.7 or later. Update Macs to macOS Golden Gate 27 or later.