Apple patches an EXR zero-click bug, a macOS root flaw and iCloud mail spoofing

What happened

Three Apple security items surfaced in the past weeks. All three are fixed. Two have CVE numbers. One does not.

CVE-2026-86869 is an out-of-bounds write in ImageIO, Apple's image framework. Apple fixed it on 14 September 2026. Researcher ironPeak published a write-up on how a crafted EXR image could reach it through iMessage.

CVE-2026-43783 is a local privilege escalation in macOS. Apple fixed it in macOS Tahoe 26.6 on 27 July 2026. It joined Apple's notes on 14 September. PT SWARM published its analysis on 15 September.

iCloud Mail sender spoofing has no CVE. SEC Consult's Timo Longin found two parsing bugs. They let a signed-in iCloud user send mail that looked like it came from any @icloud.com address. SEC Consult published the details on 1 October 2026.

Who is affected

For CVE-2026-86869, Apple lists iOS and iPadOS before 26.7. It also lists macOS before Golden Gate 27. The fixed builds are iOS 26.7, iPadOS 26.7 and macOS Golden Gate 27.

For CVE-2026-43783, the affected range is macOS Tahoe before 26.6. Apple's CVE record names no other macOS branch. A local app is needed to use it.

For iCloud Mail, nothing runs on your device. It was Apple's mail servers. Anyone who received mail from an @icloud.com address before the fix could have been shown a fake sender. SEC Consult says Apple's fix was verified on 9 December 2025.

What is confirmed

Apple confirms both CVEs. For 86869, Apple says a crafted image may cause unexpected app termination. NVD lists CVSS 6.5 (Medium) from a secondary source. Apple credits Niels Hofmans, Meta Red Team X, Geonha Lee and Chris Bailey of Short Circuit.

For 43783, Apple says a malicious app may gain root privileges. NVD lists CVSS 7.8 (High) from a secondary source. Apple credits several finders, and Ilya Andr (andrd3v) is one of them.

Neither CVE is in the CISA KEV catalog. CISA's SSVC entries say exploitation: none.

SEC Consult confirms the iCloud flaws. The first used stray carriage-return characters in the From header. The second used differences in how SMTP dot-stuffing is handled. Messages passed SPF, DKIM and DMARC. SEC Consult reported them in 2024. It lists no CVE.

What is not confirmed

Zero-click delivery of 86869 comes from ironPeak, not from Apple. ironPeak says it was confirmed on a real iPad. It says the bug sits outside BlastDoor. It says control of the program counter was reached only in a test setup. It says pointer authentication blocked the last step. It says memory tagging on newest chips blocked it too. Full remote code execution was not demonstrated.

Apple credits Niels Hofmans, whom TechCrunch ties to ironPeak. Apple's note does not describe an iMessage route. Treat that route as the researcher's claim.

For 43783, Apple calls the flaw a race condition fixed with better locking. PT SWARM describes a missing path check in an XPC helper, and a new entitlement check in the fix. The two descriptions differ. A public PoC exists, per PT SWARM. ThreatWire has not run it and does not link it.

No attacks are reported for either CVE. The iCloud issues were fixed long before publication. No abuse is reported.

What to do

Update iPhones and iPads to iOS or iPadOS 26.7 or later. Update Macs to macOS Golden Gate 27. Macs on the Tahoe line need macOS Tahoe 26.6 or later for the root flaw.

Turn on automatic updates. Treat unexpected image attachments with care until you update.

You do not need to act on iCloud Mail itself. It is fixed on Apple's side. Still, do not trust a sender name alone. Check links and requests, even from an @icloud.com address.

Sources: Apple security content pages, NVD, the CISA KEV catalog, ironPeak, PT SWARM, SEC Consult, TechCrunch and CyberInsider. Links are in the references.