CVE-2026-84575

Executive Summary

CVE-2026-84575 is an out-of-bounds write (CWE-787) vulnerability affecting Apple's iPadOS and other Apple operating systems. A local attacker with low privileges can trigger memory corruption by processing a maliciously crafted file, leading to unexpected application termination. Given the CVSS score of 7.8 with High Confidentiality, Integrity, and Availability impacts, this flaw poses a significant risk to enterprise environments relying on Apple devices. The absence of public PoC or exploit code reduces immediate urgency, but the broad affected ecosystem and high impact metrics warrant prioritized patching.

Technical Analysis

The vulnerability is an out-of-bounds write (CWE-787) in Apple's iPadOS and related operating systems. According to the NVD description, the issue was addressed with improved bounds checking. The attack vector is local (AV:L), requiring low privileges (PR:L) and no user interaction (UI:N). The attacker must process a maliciously crafted file, implying the vulnerability lies in a file parsing component. The out-of-bounds write occurs when the software fails to validate input length or index boundaries, allowing data to be written beyond the allocated buffer. This can corrupt adjacent memory, leading to arbitrary code execution or application termination. The specific component or file format is not detailed in the provided description; therefore, the vulnerability class is an OOB write in a file-processing context. The CVSS vector indicates High Confidentiality, Integrity, and Availability impacts, suggesting that successful exploitation could result in data disclosure, modification, and denial of service. The patch confidence is 2/4 (CLAIMED), with only NVD as the source, meaning the fix is not independently confirmed. No affected version list or OSV packages were provided, but the description lists fixed versions across multiple Apple OS platforms.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class. The exploitation scenario for CVE-2026-84575 involves a local attacker delivering a maliciously crafted file to a vulnerable Apple device. The attack chain proceeds as follows:

1. Reconnaissance/Target Identification: The attacker identifies a target running an affected version of iPadOS, iOS, macOS, tvOS, visionOS, or watchOS. This could be achieved through network scanning, social engineering, or physical access.

2. Triggering the Flaw: The attacker crafts a file designed to exploit the out-of-bounds write. Since the vulnerability requires processing a malicious file, the attacker must convince the victim to open the file or find an application that automatically processes files (e.g., via a shared folder, email attachment, or web download). The file format is not specified, but it is likely a document, media, or archive processed by a system component.

3. Payload/Execution: Upon processing, the out-of-bounds write corrupts memory. Depending on the specific context, this could lead to code execution, but the NVD description only states "unexpected app termination." Therefore, the immediate impact is a crash. However, the High Integrity and Confidentiality impacts suggest that in some scenarios, an attacker could achieve arbitrary code execution or data leakage.

4. Post-Exploitation Impact: Successful exploitation could result in application termination, denying service to the user. In a more severe scenario, memory corruption could be leveraged for arbitrary code execution, allowing the attacker to install malware, exfiltrate data, or pivot to other system components. Without public exploit details, the exact post-exploitation capabilities remain speculative but are inferred from the CVSS impact metrics.

Impact Assessment

The CVSS score of 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a serious vulnerability. The local attack vector means the attacker must have some level of access to the device or be able to deliver a file. Low privileges are required, and no user interaction is needed, which increases the likelihood of exploitation once the file is processed. The High Confidentiality, Integrity, and Availability impacts suggest that a successful exploit could lead to unauthorized data access, data modification, and system unavailability. The blast radius includes all Apple devices running the affected versions: iPadOS, iOS, macOS (Sequoia, Tahoe, Golden Gate), tvOS, visionOS, and watchOS. Enterprises with a large fleet of Apple devices face significant risk, especially if they handle sensitive data or require high availability. The EPSS score is 0.00175 (7.2% percentile), indicating a low probability of exploitation in the wild, but the lack of public PoC does not eliminate the risk, as attackers may develop private exploits.

Detection Guidance

Sigma Rule

title: Apple Out-of-Bounds Write File Processing Attempt
id: 8f9a2b3c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects potential exploitation of CVE-2026-84575 via malicious file processing
author: valtersit.com
date: 2026-06-15
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
      - '/Preview'
      - '/QuickLook'
      - '/mdworker'
      - '/coreaudiod'
  condition: selection
falsepositives:
  - Legitimate file processing
level: medium

YARA Rule

rule CVE_2026_84575_OOB_Write
{
    meta:
        description = "Detects files attempting to exploit CVE-2026-84575"
        author = "valtersit.com"
        date = "2026-06-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84575"
        hash = "unknown"
    strings:
        $a = { 00 00 00 00 00 00 00 00 } // placeholder for crafted file pattern
        $b = "malicious" nocase
    condition:
        $a or $b
}

Note: Specific file patterns are unknown; this is a generic template.

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-84575 Apple Out-of-Bounds Write Attempt"; flow:to_client; content:"|00 00 00 00|"; depth:4; classtype:attempted-user; sid:1000001; rev:1;)

Note: Network detection is limited as the attack vector is local; this rule is a placeholder.

Elastic Detection

process where process.name in ("Preview", "QuickLook", "mdworker") and process.args : "*.pdf"

Note: Generic detection for file processing; not specific to CVE-2026-84575.

Splunk SPL Query

index=macos sourcetype=process_creation (Image=*Preview* OR Image=*QuickLook* OR Image=*mdworker*) | stats count by Image, CommandLine

Wazuh OSSEC Rule

<rule id="100001" level="7">
  <decoded_as>json</decoded_as>
  <field name="Image">\.*(Preview|QuickLook|mdworker)$</field>
  <description>CVE-2026-84575: Potential Apple OOB write exploitation attempt</description>
  <mitre>
    <id>T1203</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate Mitigations:

   • Restrict processing of untrusted files on affected Apple devices.
   • Disable automatic file preview or Quick Look features where possible.
   • Implement application allowlisting to prevent execution of unknown binaries.
   • Monitor for suspicious file processing events.

2. Patch/Upgrade Steps:

   • Upgrade to the fixed versions: iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27.
   • Verify patch availability through Apple's official security updates.
   • Since patch confidence is CLAIMED, validate the fix by testing in a controlled environment.

3. Long-Term Hardening:

   • Enable automatic updates for Apple devices.
   • Conduct regular vulnerability scanning and patch management.
   • Educate users on the risks of opening files from untrusted sources.
   • Implement endpoint detection and response (EDR) solutions with memory protection features.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-84575
• Apple Security Updates: https://support.apple.com/en-us/HT201222
• CWE-787: https://cwe.mitre.org/data/definitions/787.html
• EPSS: https://www.first.org/epss/
• MITRE ATT&CK T1203: https://attack.mitre.org/techniques/T1203/

No known threat actor campaigns or exploit-in-the-wild evidence at this time.