CVE-2026-86990

CVE-2026-86990 is an access-control vulnerability affecting Apple's CoreMedia framework, which is used to handle multimedia across various Apple operating systems. Discovered and reported by security researcher Mustafa Calap, the flaw allows a malicious application installed on a device to access the camera without obtaining the user's permission. Unlike other vulnerabilities patched in the same release cycle, there have been no reports of this specific flaw being actively exploited in the wild. Apple resolved the issue by implementing tightened access restrictions within the CoreMedia component. The fix has been deployed across a wide range of Apple platforms, including updates for iOS and iPadOS (versions 18.7.11, 26.7.2, and 27.2), macOS Golden Gate (27.2), macOS Tahoe (26.7.2), and visionOS (27.2). This ensures protection for both newer and older supported devices, such as iPhones, iPads, Macs, and Apple Vision Pro headsets.