CVE-2026-86962: 
macOS vulnerability analysis and mitigation

CVE-2026-86962 is a double free vulnerability in the Kernel component of multiple Apple operating systems that allows a locally installed app to cause unexpected system termination. It affects iOS and iPadOS (before 26.7 and before 27), macOS Sequoia (before 15.8), macOS Tahoe (before 26.7), macOS Golden Gate (before 27), tvOS (before 27), visionOS (before 27), and watchOS (before 27). The vulnerability was disclosed on October 20, 2026, with patches released on September 14, 2026 (OS releases) and additional CVE entries added October 19, 2026. A CVSS base score has not yet been formally assigned; Feedly estimates the severity as Medium (Feedly, GitHub Advisory).

The vulnerability is classified as a double free (CWE-415), a memory management flaw where a program attempts to free the same memory region twice, potentially corrupting heap metadata. In Apple's Kernel component, this condition can be triggered by a locally installed app, leading to unexpected system termination (denial of service). Apple addressed the issue with improved memory management. The vulnerability was reported by OpenAI and Hüseyin Kabasakal (@HuseyinK01) (Apple tvOS 27 Advisory, Apple watchOS 27 Advisory). No public technical write-up or proof-of-concept code has been identified.

Successful exploitation of this vulnerability allows a locally installed app to cause unexpected system termination, resulting in a denial-of-service condition on the affected device. The impact is limited to availability — there is no evidence that this vulnerability enables code execution, privilege escalation, or data exfiltration. All major Apple platforms are affected, including iPhones, iPads, Macs, Apple TV, Apple Watch, and Apple Vision Pro (Feedly, Apple tvOS 27 Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is reported as 0.0, indicating a very low probability of exploitation in the near term. The vulnerability requires a locally installed app to trigger, meaning remote exploitation without prior app installation is not possible. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.

Apple has released patches across all affected platforms. Users should update to the following versions or later: iOS 26.7 or iOS 27, iPadOS 26.7 or iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. No configuration-based workaround is available; upgrading to a patched OS version is the only remediation. Additionally, restricting the installation of untrusted or unvetted apps reduces exposure (Apple iOS 27 Advisory, Apple tvOS 27 Advisory, Apple watchOS 27 Advisory).