CVE-2026-86879

Published Sep 14, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. A remote attacker may be able to cause a denial-of-service.

Analysis

Technical impact

An improper input validation flaw exists in iOS and iPadOS that allows a remote attacker to provoke a denial‑of‑service and carries a CVSS score of 6.5, indicating a medium impact if successfully exploited.

Affected Systems

The flaw affects all Apple iOS and iPadOS devices on versions prior to iOS 27 and iPadOS 27. Devices running the patched releases are immune.

Risk and Exploitability

Based on the description, the remote nature of the attack and the lack of a publicly disclosed exploit make the actual exploitation probability uncertain, but the medium CVSS score is not listed in the CISA KEV catalog, and its EPSS score is less than 1%. Based on the description, it is inferred that an attacker could trigger the DoS by sending specially crafted input to the vulnerable component, potentially without authentication.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 27

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::

No data.

Vendor Product Versions

Apple

Ios And Ipados

Version	Status	Scheme	Platform
`[0,27)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install iOS 27 or later (iPadOS 27 or later) to apply the input validation fix.
If an update cannot be applied immediately, consider restricting access to the vulnerable functionality or network path until the patch is available; use device management policies to limit exposure.
Monitor device logs and performance metrics for repeated crashes or service restarts, and alert administrators when patterns consistent with the DoS occur.

Generated by OpenCVE AI on October 20, 2026 at 13:08 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.394% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://support.apple.com/en-us/149034

History

Oct 20, 2026 1:45 PM Title updated View changes

Type	Values Removed	Values Added
Title	Denial-of-Service via Improper Input Validation in Apple iOS and iPadOS

Oct 20, 2026 2:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 20, 2026 9:45 PM Title updated View changes

Type	Values Removed	Values Added
Title		Denial-of-Service via Improper Input Validation in Apple iOS and iPadOS

Sep 16, 2026 1:00 PM Title updated View changes

Type	Values Removed	Values Added
Title	Remote Denial-of-Service via Improper Input Validation in iOS/iPadOS

Sep 15, 2026 5:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple ipados Apple iphone Os
CPEs		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os::::::::
Vendors & Products		Apple ipados Apple iphone Os

Sep 15, 2026 11:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		Remote Denial-of-Service via Improper Input Validation in iOS/iPadOS

Sep 15, 2026 3:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados
Vendors & Products		Apple Apple ios And Ipados

Sep 14, 2026 11:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-20
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 14, 2026 9:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. A remote attacker may be able to cause a denial-of-service.
References		https://support.apple.com/en-us/149034