CVE-2026-86916
published 2026-10-26CVE-2026-86916: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate…
PriorityP346high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.20%
10.3th percentile
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7.2. An app may be able to execute arbitrary code with kernel privileges.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_and_ipados | < 26.7 | 26.7 |
| apple | ios_and_ipados | < 27 | 27 |
| apple | macos | < 15.8 | 15.8 |
| apple | macos | < 26.7.2 | 26.7.2 |
| apple | macos | < 27 | 27 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A use after free issue was addressed with improved memory management.
ghsa_unreviewed·2026-10-26
CVE-2026-86916 [HIGH] CWE-416 A use after free issue was addressed with improved memory management.
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7.2. An app may be able to execute arbitrary code with kernel privileges.
VulDB
Apple iOS/iPadOS/macOS prior macOS Tahoe 26.7.2 Memory Management use after free
vuldb·2026-10-26
CVE-2026-86916 Apple iOS/iPadOS/macOS prior macOS Tahoe 26.7.2 Memory Management use after free
A vulnerability has been found in Apple iOS, iPadOS and macOS and classified as very critical. Affected is an unknown function of the component Memory Management. Performing a manipulation results in use after free.
This vulnerability is known as CVE-2026-86916. Remote exploitation of the attack is possible. No exploit is available.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
2026-10-26
Published