visionOS 27

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted image may lead to unexpected process termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-86882: Peter Malone

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted image may lead to unexpected app termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-86918: Arni Hardarson (Neonix Security)

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination or write kernel memory

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-84523: Cem Onat Karagun, an anonymous researcher

Available for: Apple Vision Pro (all models)

Impact: An app may be able to access sensitive user data

Description: A privacy issue was addressed with improved access restrictions.

CVE-2026-84582: Zhongcheng Li (CK01)

Available for: Apple Vision Pro (all models)

Impact: A local app may be able to read a persistent account identifier

Description: A permissions issue was addressed with additional restrictions.

CVE-2026-86888: Zhongcheng Li (CK01)

Available for: Apple Vision Pro (all models)

Impact: An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account

Description: An authentication issue was addressed with improved state management.

CVE-2026-20683: Dem0ns (@天府简易信工作室), Abdelhak Kherroubi, Jasminder Pal Singh, Lehan Dilusha Jayasingha (Sri Lanka)

Available for: Apple Vision Pro (all models)

Impact: An app may be able to access sensitive user data

Description: An authorization issue was addressed with improved state management.

CVE-2026-86920: Johan Wahyudi

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination or write kernel memory

Description: A race condition was addressed with additional validation.

CVE-2026-84634: S. Rosario

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-84595: tamdao

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination

Description: A use after free issue was addressed with improved memory management.

CVE-2026-65407: Franco Belman at Blackwing Intelligence

Available for: Apple Vision Pro (all models)

Impact: An app may be able to leak sensitive user information

Description: A logic issue was addressed with improved checks.

CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin

Available for: Apple Vision Pro (all models)

Impact: An app may be able to delete credentials stored in Keychain

Description: This issue was addressed by removing the vulnerable code.

CVE-2026-86905: Ilya Andr (andrd3v)

Available for: Apple Vision Pro (all models)

Impact: A local app may be able to read a persistent account identifier

Description: A permissions issue was addressed with additional restrictions.

CVE-2026-84583: Zhongcheng Li from IES Red Team

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination

Description: The issue was addressed with improved checks.

CVE-2026-65410: Calif.io in collaboration with Claude and Anthropic Research

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination

Description: A type confusion issue was addressed with improved memory handling.

CVE-2026-84616: Peter Malone

Available for: Apple Vision Pro (all models)

Impact: A sandboxed app may be able to execute arbitrary code with kernel privileges

Description: A race condition was addressed with improved state management.

CVE-2026-84607: Ruslan Dautov

Available for: Apple Vision Pro (all models)

Impact: An app may be able to access sensitive user data

Description: A logic issue was addressed with improved validation.

CVE-2026-65406: Ye Zhang (@VAR10CK) of Baidu Security

Available for: Apple Vision Pro (all models)

Impact: An app may gain unauthorized access to Bluetooth

Description: An authorization issue was addressed with improved state management.

CVE-2026-84560: an anonymous researcher

Available for: Apple Vision Pro (all models)

Impact: An attacker in radio range may be able to cause unexpected system termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-84613: jioundai

Available for: Apple Vision Pro (all models)

Impact: A local app may be able to read a persistent account identifier

Description: An information disclosure issue was addressed with improved state management.

CVE-2026-86895: Stanislav Jelezoglo

Available for: Apple Vision Pro (all models)

Impact: An app may be able to read device name

Description: A permissions issue was addressed with additional restrictions.

CVE-2026-86893: Heiner Gerdes

Available for: Apple Vision Pro (all models)

Impact: An archive may be able to bypass Gatekeeper

Description: A file quarantine bypass was addressed with additional checks.

CVE-2026-65399: Rishabh Jain (rjcyber) of cyberplanet, Pasquale Scola, an anonymous researcher

Available for: Apple Vision Pro (all models)

Impact: An app may be able to modify protected parts of the file system

Description: This issue was addressed with improved handling of symlinks.

CVE-2026-86966: Jihwan Yoon

Available for: Apple Vision Pro (all models)

Impact: An attacker with a paired Bluetooth device may be able to execute arbitrary code

Description: A stack overflow was addressed with improved input validation.

CVE-2026-86919: Mathis Mansière

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted Bluetooth packet may result in disclosure of process memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-112608: Duc Anh Nguyen & Ta Duc Thien

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: A memory corruption issue was addressed by removing the vulnerable code.

CVE-2026-64752: Nik Tsytsarkin

Available for: Apple Vision Pro (all models)

Impact: A sandboxed process may be able to circumvent sandbox restrictions

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-86876: Chris Bailey - Short Circuit

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted video file may lead to unexpected app termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-65344: Siyeong kim

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory

Description: A use after free issue was addressed with improved memory management.

CVE-2026-86913: Meta Product Security

Available for: Apple Vision Pro (all models)

Impact: A sandboxed app may be able to access restricted files

Description: A permissions issue was addressed with improved path validation.

CVE-2026-84624: AL Najafi, tamdao

Available for: Apple Vision Pro (all models)

Impact: Processing web content may lead to a denial-of-service

Description: A null pointer dereference was addressed with improved input validation.

CVE-2026-65412: Pavan Nallamothu

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted font may result in the disclosure of process memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-84596: ret2happy, Meta Product Security

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted file may lead to unexpected app termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-84575: Mustafa Calap (@ordinal0, dbg.re)

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted image may lead to unexpected app termination

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2026-84571: stratan (@5tratan), Peter Malone

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted asset catalog may lead to unexpected process termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-84511: Rahul Raj, stratan (@5tratan)

Available for: Apple Vision Pro (all models)

Impact: An app may be able to read persistent device identifiers

Description: An authorization issue was addressed with improved access control.

CVE-2026-84612: N.M.Praveen Nawarathne (@zblockrat), James Gill (@jjtech@infosec.exchange)

Available for: Apple Vision Pro (all models)

Impact: An app may be able to modify a file it only had permission to read

Description: A permissions issue was addressed with additional restrictions.

CVE-2026-43785: Junyeong Lee (jylab.github.io), Merrick Hare, Aditya Kumar, John Nzyuko Uvyu, Narendra Singh (@_3P1C)

Available for: Apple Vision Pro (all models)

Impact: Extracting a maliciously crafted archive may allow an attacker to write arbitrary files

Description: A path handling issue was addressed with improved validation.

CVE-2026-84534: Geoffrey Lovelace

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted font file may lead to unexpected app termination

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-84524: an anonymous researcher

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted font may result in the disclosure of process memory

Description: An out-of-bounds read issue was addressed with improved input validation.

CVE-2026-84597: Nik Tsytsarkin

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause a denial of service

Description: A type confusion issue was addressed with improved memory handling.

CVE-2026-65409: Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination

Description: A race condition was addressed with improved state handling.

CVE-2026-84492: Tommy DeVoss from Braze Security Team (@thedawgyg), Jiyong Yang

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause a denial-of-service

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-86942: He Wei (ギカク)

Available for: Apple Vision Pro (all models)

Impact: An app may be able to identify a user across reinstalls

Description: A privacy issue was addressed with improved handling of identifiers.

CVE-2026-84606: Ilya Andr (andrd3v)

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted image may result in disclosure of process memory

Description: An uninitialized memory issue was addressed with improved memory initialization.

CVE-2026-84564: Justin O'Leary (@olearysec) of olearysec.com

Available for: Apple Vision Pro (all models)

Impact: Processing an image may lead to a denial-of-service

Description: The issue was addressed with improved checks.

CVE-2026-65347: Geonha Lee (@leegn4a)

Available for: Apple Vision Pro (all models)

Impact: Processing an image may lead to arbitrary code execution

Description: An integer overflow was addressed with improved input validation.

CVE-2026-65346: Meta Red Team X - Nik Tsytsarkin

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted image may result in memory corruption

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-65395: Mateusz Jurczyk of Google Project Zero, Varik Matevosyan

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted image may lead to unexpected process termination

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-86975: Tommy DeVoss from Braze Security Team (@thedawgyg), an anonymous researcher

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted image may lead to unexpected app termination

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-86954: Mateusz Jurczyk of Google Project Zero

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to memory corruption

Description: The issue was addressed with improved memory handling.

CVE-2026-64788: Chanwit Muenprakoddee (ChemIndy), an anonymous researcher, f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao Lin@Y1nkoc and 云散花折, Arjanit Isufi

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination

Description: A use after free issue was addressed with improved memory management.

CVE-2026-28969: Mihalis Haatainen, Ashish Kunwar, Ari Hawking, 이재영

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination or corrupt kernel memory

Description: An out-of-bounds access issue was addressed with improved bounds checking.

CVE-2026-65398: Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0, dbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin

CVE-2026-64736: Ruslan Dautov, hxr1

Available for: Apple Vision Pro (all models)

Impact: An app may be able to leak sensitive kernel state

Description: An information leakage was addressed with additional validation.

CVE-2026-64760: an anonymous researcher, Seiji Sakurai (@HeapSmasher), Franco Belman at Blackwing Intelligence

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination or corrupt kernel memory

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-28968: genter0, Svetoslav Stolarov, Josh Maine of Calif.io, Dun

Available for: Apple Vision Pro (all models)

Impact: A local user may be able to cause unexpected system termination or read kernel memory

Description: A race condition was addressed with additional validation.

CVE-2026-65415: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)

Available for: Apple Vision Pro (all models)

Impact: A remote attacker may be able to cause unexpected system termination

Description: A use after free issue was addressed with improved memory management.

CVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination or read kernel memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2026-65349: an anonymous researcher

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination or corrupt kernel memory

Description: A double free issue was addressed with improved memory management.

CVE-2026-84561: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Bhaswanth Chigurupati

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination

Description: A race condition was addressed with improved state handling.

CVE-2026-84630: Tristan Madani (@TristanInSec) from Talence Security

CVE-2026-65360: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

CVE-2026-65358: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2026-65377: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ye Zhang (@VAR10CK) of Baidu Security

Available for: Apple Vision Pro (all models)

Impact: An app with root privileges may be able to read uninitialized kernel memory

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2026-84622: Hiroki Imai (LAC Co., Ltd.)

Available for: Apple Vision Pro (all models)

Impact: A malicious app may be able to gain root privileges

Description: A permissions issue was addressed with additional restrictions.

CVE-2026-43689: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs

Available for: Apple Vision Pro (all models)

Impact: Connecting to a malicious NFS server may disclose kernel memory

Description: The issue was addressed with improved memory handling.

CVE-2026-43687: R4mbb of KRsecurity, Peter Malone

Available for: Apple Vision Pro (all models)

Impact: Connecting to a malicious NFS server may lead to kernel memory corruption

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-43686: Peter Malone

Available for: Apple Vision Pro (all models)

Impact: An app may be able to determine kernel memory layout

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2026-65405: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Available for: Apple Vision Pro (all models)

Impact: An app may be able to disclose kernel memory

Description: An information disclosure issue was addressed with improved memory management.

CVE-2026-84530: Vladislav Shevchenko (Positive Technologies)

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination

Description: A use after free issue was addressed with improved memory management.

CVE-2026-84521: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

CVE-2026-65402: Fábio Luís @scanpt, Richard Zana, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Available for: Apple Vision Pro (all models)

Impact: A local user may be able to cause unexpected system termination or read kernel memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-65359: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination or corrupt kernel memory

Description: A race condition was addressed with improved state handling.

CVE-2026-84507: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Available for: Apple Vision Pro (all models)

Impact: An app may be able to disclose kernel memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2026-86903: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination or corrupt kernel memory

Description: The issue was addressed with improved memory handling.

CVE-2026-65330: Ashish Kunwar, Mikhail Lozhnikov of Positive Technologies, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Bhaswanth Chigurupati

CVE-2026-28935: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

CVE-2026-84599: an anonymous researcher

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination

Description: A type confusion issue was addressed with improved checks.

CVE-2026-84602: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination

Description: A double free issue was addressed with improved memory management.

CVE-2026-86962: OpenAI, Hüseyin Kabasakal @HuseyinK01

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause unexpected system termination

Description: A null pointer dereference was addressed with improved input validation.

CVE-2026-86964: Ryan Hileman via Xint Code (xint.io)

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted file may lead to unexpected app termination

Description: A heap buffer overflow was addressed with improved bounds checking.

CVE-2026-86870: Kitten Food

Available for: Apple Vision Pro (all models)

Impact: An app may be able to access sensitive user data

Description: A privacy issue was addressed with improved handling of files.

CVE-2026-86883: Sindre Sorhus, Morris Richman (@morrisinlife), Stuart Wallace, Tristan Brennan

Available for: Apple Vision Pro (all models)

Impact: A sandboxed app may be able to access the System Keychain

Description: An authorization issue was addressed with improved state management.

CVE-2026-84628: Myeonghun Pak, Nathaniel Oh (@calysteon), Alan Banderas (@creeper4004)

Available for: Apple Vision Pro (all models)

Impact: An app may be able to modify protected parts of the file system

Description: A path handling issue was addressed with improved validation.

CVE-2026-65411: Rodolphe Brunetti (@eisw0lf) of Lupus Nova

Available for: Apple Vision Pro (all models)

Impact: Opening a maliciously crafted file may lead to unexpected process termination

Description: A buffer overflow was addressed with improved size validation.

CVE-2026-84497: Yiğit Can YILMAZ (@yilmazcanyigit)

Available for: Apple Vision Pro (all models)

Impact: An app may be able to access sensitive user data

Description: An authorization issue was addressed with improved state management.

CVE-2026-84615: Stanislav Jelezoglo

Available for: Apple Vision Pro (all models)

Impact: An app may be able to access sensitive user data

Description: An authorization issue was addressed with improved state management.

CVE-2026-43695: Claudio Bozzato and Francesco Benvenuto of Cisco Talos

Available for: Apple Vision Pro (all models)

Impact: An app may be able to identify what other apps a user has installed

Description: An information disclosure issue was addressed with improved state management.

CVE-2026-84626: Hoffcona of IES Red Team

Available for: Apple Vision Pro (all models)

Impact: An app may be able to access sensitive user data

Description: A permissions issue was addressed with additional restrictions.

CVE-2026-84491: an anonymous researcher

Available for: Apple Vision Pro (all models)

Impact: An app may be able to fingerprint the user

Description: This issue was addressed with additional entitlement checks.

CVE-2026-84629: Stanislav Jelezoglo

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted image may lead to heap corruption

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2026-84627: Mateusz Jurczyk of Google Project Zero, Piotr Jerzy Duszynski, f0r of MurphySec, PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj, ธนกฤต ทัฬหะ

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted file may lead to unexpected app termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-28966: stratan (@5tratan)

Available for: Apple Vision Pro (all models)

Impact: Opening a maliciously crafted file may cause unexpected process termination or disclose process memory

Description: An out-of-bounds read issue was addressed with improved input validation.

CVE-2026-84532: Franco Belman at Blackwing Intelligence, Hongsik Kim (mnur), stratan (@5tratan)

Available for: Apple Vision Pro (all models)

Impact: An app may be able to access sensitive user data

Description: This issue was addressed with improved checks.

CVE-2026-65403: Rahul Raj

Available for: Apple Vision Pro (all models)

Impact: An app may be able to access sensitive user data

Description: This issue was addressed with additional entitlement checks.

CVE-2026-86897: Stuart Wallace

Available for: Apple Vision Pro (all models)

Impact: An app may be able to bypass network restrictions

Description: A logic issue was addressed with improved validation.

CVE-2026-84551: Issa Sancho

Available for: Apple Vision Pro (all models)

Impact: An app may be able to fingerprint the user

Description: A permissions issue was addressed with additional sandbox restrictions.

CVE-2026-84625: Ilya Andr (andrd3v) of Positive Technologies, CJ Vana

Available for: Apple Vision Pro (all models)

Impact: An app may be able to access sensitive user data

Description: A permissions issue was addressed with additional restrictions.

CVE-2026-84603: Gongyu Ma (@Mezone0), CJ Vana, Stanislav Jelezoglo

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted file may result in disclosure of process memory

Description: An integer overflow was addressed with improved input validation.

CVE-2026-84487: stratan (@5tratan), Dhiyanesh Selvaraj (@redroot97), Peter Malone

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted 3D model may lead to memory corruption

Description: The issue was addressed with improved memory handling.

CVE-2026-84632: Peter Malone

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted 3D model may lead to memory corruption

Description: An integer overflow was addressed with improved input validation.

CVE-2026-84620: Peter Malone

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted 3D model may lead to memory corruption

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-84546: Narendra Singh (@_3P1C), stratan (@5tratan), Peter Malone

CVE-2026-84611: Nathaniel Oh (@calysteon)

Available for: Apple Vision Pro (all models)

Impact: Processing a maliciously crafted 3D scene may lead to unexpected process termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-84526: stratan (@5tratan)

Available for: Apple Vision Pro (all models)

Impact: An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages

Description: A certificate validation issue was addressed with improved certificate validation.

CVE-2026-86881: Surya Narayan Kushwaha, Roman Zabicki, John Lussier, Filip Olszak

Available for: Apple Vision Pro (all models)

Impact: An app may be able to access protected user data

Description: This issue was addressed with improved validation of the caller's access.

CVE-2026-84508: Abodi Dawoud, Merrick Hare, Roelof van Dijk

Available for: Apple Vision Pro (all models)

Impact: A malicious shortcut may be able to send messages without user confirmation

Description: An authorization issue was addressed with improved state management.

CVE-2026-84600: Owen Pawling (@owenpawling)

Available for: Apple Vision Pro (all models)

Impact: An app may be able to access sensitive user data

Description: An authorization issue was addressed with improved state management

CVE-2026-28850: OSORI

Available for: Apple Vision Pro (all models)

Impact: A local attacker may be able to overwrite restricted files

Description: A permissions issue was addressed with improved validation.

CVE-2026-86921: Jonghoon Han (Aegis), bubu, 이재영, Tae Woo Kim, Dawuge of Shuffle Team

Available for: Apple Vision Pro (all models)

Impact: An app may be able to modify protected system files

Description: A permissions issue was addressed with improved path validation.

CVE-2026-84609: YingMuo (@YingMuo) of DEVCORE Research Team

Available for: Apple Vision Pro (all models)

Impact: An app may be able to cause a denial-of-service

Description: This issue was addressed with additional entitlement checks.

CVE-2026-86892: Lehan Dilusha Jayasingha

Available for: Apple Vision Pro (all models)

Impact: A malicious application may be able to determine a user's current location

Description: A privacy issue was addressed with improved private data redaction for log entries.

CVE-2026-84513: Sindre Sorhus

Available for: Apple Vision Pro (all models)

Impact: An app may be able to access sensitive user data

Description: A logging issue was addressed with improved data redaction.

CVE-2026-84527: Zeyang Li&Yuxiang Wang of Chongqing Telecom

Available for: Apple Vision Pro (all models)

Impact: An app may be able to bypass certain Privacy preferences

Description: A privacy issue was addressed by removing sensitive data.

CVE-2026-86887: an anonymous researcher

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: An out-of-bounds access issue was addressed with improved bounds checking.

CVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to an unexpected process termination

Description: A logic issue was addressed with improved state management.

CVE-2026-84635: Souta Sugiyama

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: The issue was addressed with improved memory handling.

CVE-2026-43795: wwwlk

CVE-2026-65338: OpenAI Codex Security - Amy Burnett

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to memory corruption

Description: The issue was addressed with improved memory handling.

CVE-2026-65341: Henock Habte

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: A memory corruption vulnerability was addressed with improved locking.

CVE-2026-64782: Charles Kern, Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may disclose sensitive user information

Description: A permissions issue was addressed by removing the vulnerable code.

CVE-2026-64753: Viggo Lekdorf

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: The issue was addressed with improved input validation.

CVE-2026-64781: Thomas Guillem

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: This issue was addressed through improved state management.

CVE-2026-65351: Niels Hofmans

CVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo)

CVE-2026-65337: OpenAI Codex Security - Amy Burnett

CVE-2026-65336: Josef Korbel

CVE-2026-65335: OpenAI Codex Security - Amy Burnett

CVE-2026-65333: OpenAI Codex Security - Amy Burnett

CVE-2026-65332: Kun Peeks (@SwayZGl1tZyyy), OpenAI Codex Security - Amy Burnett

CVE-2026-65331: OpenAI Codex Security - Amy Burnett

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to an unexpected process termination

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-64787: 杉山 壮太, Shubham Chaskar

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: The issue was addressed with improved checks.

CVE-2026-64780: OpenAI Codex Security - Amy Burnett

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: A memory corruption issue was addressed with improved state management.

CVE-2026-65334: OpenAI Codex Security - Amy Burnett

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to memory corruption

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2026-43794: Dung Do (@_piers2) of Calif.io

Available for: Apple Vision Pro (all models)

Impact: Opening a maliciously crafted webarchive file may lead to universal cross-site scripting

Description: A logic issue was addressed with improved state management.

CVE-2026-86898: Tomi Garcia (archyxsec)

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: A type confusion issue was addressed with improved state management.

CVE-2026-86922: Nathaniel Oh (@calysteon), Kwak Kiyong / kakaogames

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to unexpected behavior

Description: A logic issue was addressed with improved state management.

CVE-2026-86872: Junhyuk Im of S2W Inc, Seungyun Lee of S2W Inc

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-64718: Niels Hofmans, OGINOME Tomohito, an anonymous researcher

Available for: Apple Vision Pro (all models)

Impact: Visiting a maliciously crafted website may leak sensitive data

Description: The issue was addressed with improved checks.

CVE-2026-64778: Mohit Negi

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: A memory corruption vulnerability was addressed with improved locking.

CVE-2026-64779: Tommy DeVoss from Braze Security Team (@thedawgyg), Shubham Chaskar

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to memory corruption

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-65391: Myungyong Lee

Available for: Apple Vision Pro (all models)

Impact: Processing maliciously crafted web content may lead to memory corruption

Description: An integer overflow was addressed with improved input validation.

CVE-2026-65390: Kwak Kiyong (@Pwnkai23), Song Nuri

Available for: Apple Vision Pro (all models)

Impact: An attacker in physical proximity may be able to cause a denial-of-service

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-86953: Efstratios Kaplanellis (@5tratan) of Almamater Technologies, Jakob Pammer

Available for: Apple Vision Pro (all models)

Impact: An attacker in wireless proximity may be able to cause unexpected system termination

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-86957: Drin Raci of sentry.security, Niels Hofmans

Available for: Apple Vision Pro (all models)

Impact: An app may be able to access sensitive user data

Description: An authorization issue was addressed with improved state management.

CVE-2026-84636: Sindre Sorhus, Jian Lee (@speedyfriend433)