AI description
**CVE-2026-86869**, also referred to by security researchers as "EX-ARRR," is an out-of-bounds write vulnerability affecting Apple's image processing components, specifically the `libAppleEXR` image decoder within the ImageIO framework. The flaw occurs when the decoder processes a maliciously crafted RGB OpenEXR (`.exr`) image. Due to insufficient bounds checking, the decoder allocates 12 bytes per pixel but writes 16 bytes per pixel for four-channel RGBA data, resulting in a heap overflow and memory corruption that can cause the target application to terminate unexpectedly. Because the vulnerability resides in the image rendering pipeline, it can be triggered as a zero-click exploit through messaging platforms like iMessage. Background processes, such as photo-library indexing and thumbnail generation, can automatically decode the malicious attachment upon delivery without requiring any interaction from the user. Apple addressed this issue in September 2026 by implementing improved bounds checking in iOS 26.7, iPadOS 26.7, and macOS Golden Gate 27.
- Description
- An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Golden Gate 27. Processing a maliciously crafted image may lead to unexpected app termination.
- Source
- product-security@apple.com
- NVD status
- Analyzed
- Products
- ipados, iphone_os, macos
CVSS 3.1
- Type
- Secondary
- Base score
- 6.5
- Impact score
- 3.6
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Severity
- MEDIUM
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- CWE-787
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
6
🍎 Apple patched 3 things worth your attention: 1️⃣ CVE-2026-86869: an iMessage image (EXR) could crash the decoder with no tap needed. The researcher confirmed the zero-click trigger on a real iPad. Full code execution was NOT shown. Fixed in iOS/iPadOS 26.7 and macOS Gol
@ThreatWire_
17 Oct 2026
3053 Impressions
1 Retweet
24 Likes
21 Bookmarks
1 Reply
0 Quotes
Three Apple Ecosystem Vulnerabilities: Zero-Click Memory Corruption, iCloud Sender Spoofing, and Root Privilege Escalation Read on dbugs: https://t.co/bdWMqbpmid • CVE-2026-86869: Zero-Click via iMessage and OpenEXR Researcher ironPeak discovered a heap buffer overflow in
@ptdbugs
15 Oct 2026
1018 Impressions
3 Retweets
8 Likes
6 Bookmarks
1 Reply
1 Quote
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0896A319-539F-45D2-ACA1-7225AE5C06ED",
"versionEndExcluding": "26.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B331E4FC-727F-403B-8689-E647A51204FD",
"versionEndExcluding": "26.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7FD79C64-A33E-4DDB-BDE6-4E272788FF66",
"versionEndExcluding": "27.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]