CVE-2026-84616Medium· 5.5▾ TwilightPoC available

A type confusion issue was addressed with improved memory handling

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An a…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score42/ 100 · Moderate

impact 30.3 · likelihood 0 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Sep 14, 2026

Updated

Sep 18, 2026

CVSS

5.5

Vendor

apple

Product

ipados

CWE

CWE-441

Depth score

42 · Moderate

EPSS

0.11% · p2

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-09-21

GitHub PoCs

1 public repository

Ping-2o/ios.CVE-2026-84616-84607 ↗

CISA SSVC

decided 2026-09-17

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Sep 15.

0.2% → 0.1%▼ 0.06%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

6 events · 4 days

Sep 14, 2026Published
Disclosed via NVD
Sep 15, 2026EPSS first tracked
0.2%
Sep 17, 2026Public exploit observed
1 GitHub repo
Sep 17, 2026CVSS changed
— → 5.5
Sep 17, 2026Severity changed
none → medium
Sep 18, 2026Record revised
Last analysed / modified upstream

apple CWE-441 #nvd #exploit-available #cve.org

Affected

ipados < 26.7
iphone_os < 26.7
macos >= 15.0, < 15.8
macos >= 26.0, < 26.7
tvos < 27.0
visionos < 27.0
watchos < 27.0

Patched in

ipados 26.7
iphone_os 26.7
macos 26.7
tvos 27.0
visionos 27.0
watchos 27.0

Full technical detail▾

Overview

Affected

ipados < 26.7
iphone_os < 26.7
macos >= 15.0, < 15.8
macos >= 26.0, < 26.7
tvos < 27.0
visionos < 27.0
watchos < 27.0

Remediation

Upgrade past the affected range:

ipados 26.7
iphone_os 26.7
macos 26.7
tvos 27.0
visionos 27.0
watchos 27.0

References

Change history

Field changes observed since this record was first indexed.

Sep 17, 2026Public exploit / PoC published
Sep 17, 2026CVSS — → 5.5
Sep 17, 2026Severity none → medium

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available#cve.org

← Back to feed

CVE-2026-84616Medium· 5.5▾ TwilightPoC available

A type confusion issue was addressed with improved memory handling

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score42/ 100 · Moderate

impact 30.3 · likelihood 0 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Sep 14, 2026

Updated

Sep 18, 2026

CVSS

5.5

Vendor

apple

Product

ipados

CWE

CWE-441

Depth score

42 · Moderate

EPSS

0.11% · p2

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-09-21

GitHub PoCs

1 public repository

Ping-2o/ios.CVE-2026-84616-84607 ↗

CISA SSVC

decided 2026-09-17

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Sep 15.

0.2% → 0.1%▼ 0.06%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

6 events · 4 days

Sep 14, 2026Published
Disclosed via NVD
Sep 15, 2026EPSS first tracked
0.2%
Sep 17, 2026Public exploit observed
1 GitHub repo
Sep 17, 2026CVSS changed
— → 5.5
Sep 17, 2026Severity changed
none → medium
Sep 18, 2026Record revised
Last analysed / modified upstream

apple CWE-441 #nvd #exploit-available #cve.org

Affected

ipados < 26.7
iphone_os < 26.7
macos >= 15.0, < 15.8
macos >= 26.0, < 26.7
tvos < 27.0
visionos < 27.0
watchos < 27.0

Patched in

ipados 26.7
iphone_os 26.7
macos 26.7
tvos 27.0
visionos 27.0
watchos 27.0

Full technical detail▾

Overview

Affected

ipados < 26.7
iphone_os < 26.7
macos >= 15.0, < 15.8
macos >= 26.0, < 26.7
tvos < 27.0
visionos < 27.0
watchos < 27.0

Remediation

Upgrade past the affected range:

ipados 26.7
iphone_os 26.7
macos 26.7
tvos 27.0
visionos 27.0
watchos 27.0

References

Change history

Field changes observed since this record was first indexed.

Sep 17, 2026Public exploit / PoC published
Sep 17, 2026CVSS — → 5.5
Sep 17, 2026Severity none → medium

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available#cve.org