CVE-2026-86919: Input Validation
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
iOS/iPadOSto a version that resolves this vulnerability.Fixed in 26.7 - Upgrade
Upgrade
iOS/iPadOSto a version that resolves this vulnerability.Fixed in 27 - Upgrade
Upgrade
macOS Golden Gateto a version that resolves this vulnerability.Fixed in 27 - Upgrade
Upgrade
macOS Sequoiato a version that resolves this vulnerability.Fixed in 15.8 - Upgrade
Upgrade
macOS Tahoeto a version that resolves this vulnerability.Fixed in 26.7 - Upgrade
Upgrade
visionOSto a version that resolves this vulnerability.Fixed in 27
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a Bluetooth device paired with the affected device. The available information does not describe exploitation by unpaired or remote Bluetooth devices.
Which updates contain the fix?
The issue is fixed in iOS 26.7 and iOS 27, iPadOS 26.7 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27.
What is the potential impact if exploitation succeeds?
A paired Bluetooth attacker may be able to execute arbitrary code on the affected device.