Description
A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. A remote attacker may be able to cause a denial-of-service.
Published: 2026-09-14
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

An improper input validation flaw exists in iOS and iPadOS that allows a remote attacker to provoke a denial‑of‑service and carries a CVSS score of 6.5, indicating a medium impact if successfully exploited.

Affected Systems

The flaw affects all Apple iOS and iPadOS devices on versions prior to iOS 27 and iPadOS 27. Devices running the patched releases are immune.

Risk and Exploitability

Based on the description, the remote nature of the attack and the lack of a publicly disclosed exploit make the actual exploitation probability uncertain, but the medium CVSS score is not listed in the CISA KEV catalog, and its EPSS score is less than 1%. Based on the description, it is inferred that an attacker could trigger the DoS by sending specially crafted input to the vulnerable component, potentially without authentication.

Generated by OpenCVE AI on October 20, 2026 at 13:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install iOS 27 or later (iPadOS 27 or later) to apply the input validation fix.
  • If an update cannot be applied immediately, consider restricting access to the vulnerable functionality or network path until the patch is available; use device management policies to limit exposure.
  • Monitor device logs and performance metrics for repeated crashes or service restarts, and alert administrators when patterns consistent with the DoS occur.

Generated by OpenCVE AI on October 20, 2026 at 13:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://support.apple.com/en-us/149034 cve-icon cve-icon
History

Tue, 20 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Title Denial-of-Service via Improper Input Validation in Apple iOS and iPadOS

Tue, 20 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 20 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
Title Denial-of-Service via Improper Input Validation in Apple iOS and iPadOS

Wed, 16 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Title Remote Denial-of-Service via Improper Input Validation in iOS/iPadOS

Tue, 15 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Tue, 15 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
Title Remote Denial-of-Service via Improper Input Validation in iOS/iPadOS

Tue, 15 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Vendors & Products Apple
Apple ios And Ipados

Mon, 14 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. A remote attacker may be able to cause a denial-of-service.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-10-20T00:50:45.542Z

Reserved: 2026-09-08T16:43:41.871Z

Link: CVE-2026-86879

cve-icon Vulnrichment

Updated: 2026-09-14T22:55:37.541Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-14T21:17:38.893

Modified: 2026-09-15T17:27:38.693

Link: CVE-2026-86879

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T13:15:14Z

Weaknesses
  • CWE-20

    Improper Input Validation