Description
A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. A remote attacker may be able to cause a denial-of-service.
Published: 2026-09-14
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

An improper input validation flaw exists in iOS and iPadOS that allows a remote attacker to provoke a denial‑of‑serviceOS 27 and carries a CVSS score of 7.5, indicating a high impact if successfully exploited.

Affected Systems

The flaw affects all Apple iOS and iPadOS devices on versions prior to iOS 27 and iPadOS 27. Devices running the patched releases are immune.

Risk and Exploitability

Based on the description, the remote nature of the attack and the lack of a publicly disclosed exploit make the actual exploitation probability uncertain, but the high CVSS score not listed in the CISA KEV catalog, and its EPSS score is less than 1%. Based on the description, it is inferred that an attacker could trigger the DoS by sending specially crafted input to the vulnerable component, potentially without authentication.

Generated by OpenCVE AI on September 20, 2026 at 21:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install iOS 27 or later (iPadOS 27 or later) to apply the input validation fix.
  • If an update cannot be applied immediately, consider restricting access to the vulnerable functionality or network path until the patch is available; use device management policies to limit exposure.
  • Monitor device logs and performance metrics for repeated crashes or service restarts, and alert administrators when patterns consistent with the DoS occur.

Generated by OpenCVE AI on September 20, 2026 at 21:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://support.apple.com/en-us/149034 cve-icon cve-icon
History

Sun, 20 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
Title Denial-of-Service via Improper Input Validation in Apple iOS and iPadOS

Wed, 16 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Title Remote Denial-of-Service via Improper Input Validation in iOS/iPadOS

Tue, 15 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Tue, 15 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
Title Remote Denial-of-Service via Improper Input Validation in iOS/iPadOS

Tue, 15 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Vendors & Products Apple
Apple ios And Ipados

Mon, 14 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. A remote attacker may be able to cause a denial-of-service.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-09-14T22:59:07.476Z

Reserved: 2026-09-08T16:43:41.871Z

Link: CVE-2026-86879

cve-icon Vulnrichment

Updated: 2026-09-14T22:55:37.541Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-14T21:17:38.893

Modified: 2026-09-15T17:27:38.693

Link: CVE-2026-86879

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T21:30:06Z

Weaknesses
  • CWE-20

    Improper Input Validation