CVE-2026-84566 is a high severity (CVSS 7.8) memory handling flaw in the Apple kernel. A local attacker may be able to cause unexpected system termination or corrupt kernel memory. Apple fixed it in iOS and iPadOS 26.7 and 27, and macOS Golden Gate 27, Sequoia 15.8 and Tahoe 26.7.
What's affected
The record covers macOS, iOS and iPadOS. Apple lists the fix under the Kernel component and describes the impact as follows: a local attacker may be able to cause unexpected system termination or corrupt kernel memory. Apple says the issue was addressed with improved memory handling.
The CVSS vector in the record is local, low complexity and low privileges, with no user interaction, and a high impact on confidentiality, integrity and availability. This is broader than the NFS flaws in the same updates, because the attacker already runs code on the device, such as a malicious app, and uses it to reach the kernel.
The record says the fix shipped in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7. I read Apple's pages for Golden Gate 27 and Tahoe 26.7, which list this CVE. I did not fetch the iOS, iPadOS or Sequoia pages, so I rely on the record for those.
How to check if you're exposed
Check the macOS version on each Mac:
sw_vers -productVersion
You can also open System Settings, go to General, then Software Update, and see whether an update is offered. For a fleet, read the version from your device management inventory and compare it with the fixed releases: Golden Gate 27, Sequoia 15.8 or Tahoe 26.7. A Mac on an older point release of the same major version is affected until it updates.
Apple's pages also give the list of devices each release covers. If a Mac is too old to run any of the fixed releases, plan its retirement or restrict what it can do, since it will not get this fix.
For iPhone and iPad, open Settings, then General, then About, and read the software version. Compare it with iOS or iPadOS 26.7 and 27. Devices managed through mobile device management report the same value in the inventory, so use that for a fleet view.
What to do now
- Update iPhones and iPads to iOS or iPadOS 26.7 or 27, and Macs to macOS Golden Gate 27, Sequoia 15.8 or Tahoe 26.7.
- Use mobile device management to report devices that are behind, and set a compliance deadline.
- Remove apps you do not recognise from managed devices, since a local flaw needs code running on the device.
- Keep automatic updates switched on for personal devices that access company data.
Why it matters
Apple's description is short. The record assigns CWE-119, a general class meaning a memory operation went outside the bounds of a buffer. Kernel memory corruption is one of the more serious outcomes because the kernel sits below every security boundary on the device, so a bug there can undo the protections that apps depend on.
Local escalation bugs are most useful to an attacker who has already got a foothold, for example through a malicious or compromised app. That is why the advice is the same as for every kernel fix: update every device, including iPhones and iPads. The record does not list this CVE as exploited in the wild, and it is not flagged by CISA.
Quick check
Which devices are affected?
The record lists macOS, iOS and iPadOS. Apple's pages list the exact devices and releases.
Why does a local bug matter?
An attacker with a foothold, such as a malicious app, can use a kernel flaw to gain more control. Updating removes that path.
Sources
- Apple: About the security content of macOS Golden Gate 27
- Apple: About the security content of macOS Tahoe 26.7
Last reviewed: 18 October 2026.
