{"id":"CVE-2026-84609","aliases":[],"cve":{"records":[{"id":"CVE-2026-84609","source":"apple","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-01T21:13:23.285Z","published":"2026-09-14T20:48:17.691Z","modified":"2026-10-26T20:35:50.659Z"}],"publishers":[{"name":"apple","role":"CNA","organizationId":"286789f9-fbc2-4510-9f9a-43facdede74c","modified":"2026-10-26T20:35:50.659Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-16T14:38:39.247Z"}],"references":[{"url":"https://support.apple.com/en-us/149034","tags":[],"source":"apple"},{"url":"https://support.apple.com/en-us/149035","tags":[],"source":"apple"},{"url":"https://support.apple.com/en-us/149036","tags":[],"source":"apple"},{"url":"https://support.apple.com/en-us/149037","tags":[],"source":"apple"},{"url":"https://support.apple.com/en-us/149038","tags":[],"source":"apple"},{"url":"https://support.apple.com/en-us/149042","tags":[],"source":"apple"},{"url":"https://support.apple.com/en-us/149043","tags":[],"source":"apple"}],"weaknesses":[{"id":"CWE-120","description":"CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-16T14:38:34.478035Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"A permissions issue was addressed with improved path validation.","titleSource":"apple","descriptionSource":"apple","description":"A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files.","score":9.8,"severity":"critical","published":"2026-09-14T20:48:17.691Z","modified":"2026-10-26T20:35:50.659Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apple","name":"iOS and iPadOS","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"27","versionType":"custom"}],"cpes":[],"source":"apple","url":"https://www.cve.org/CVERecord?id=CVE-2026-84609"},{"vendor":"Apple","name":"macOS","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"15.8","versionType":"custom"},{"version":"0","status":"affected","lessThan":"26.7","versionType":"custom"},{"version":"0","status":"affected","lessThan":"27","versionType":"custom"}],"cpes":[],"source":"apple","url":"https://www.cve.org/CVERecord?id=CVE-2026-84609"},{"vendor":"Apple","name":"tvOS","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"27","versionType":"custom"}],"cpes":[],"source":"apple","url":"https://www.cve.org/CVERecord?id=CVE-2026-84609"},{"vendor":"Apple","name":"visionOS","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"27","versionType":"custom"}],"cpes":[],"source":"apple","url":"https://www.cve.org/CVERecord?id=CVE-2026-84609"},{"vendor":"Apple","name":"watchOS","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"27","versionType":"custom"}],"cpes":[],"source":"apple","url":"https://www.cve.org/CVERecord?id=CVE-2026-84609"}],"remediation":[],"references":["https://support.apple.com/en-us/149034","https://support.apple.com/en-us/149035","https://support.apple.com/en-us/149036","https://support.apple.com/en-us/149037","https://support.apple.com/en-us/149038","https://support.apple.com/en-us/149042","https://support.apple.com/en-us/149043"],"sources":[{"name":"CVE","id":"CVE-2026-84609","modified":"2026-10-26T20:35:50.659Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-84609"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"sourceAffected":[],"observedAt":"2026-10-29T14:46:07.795Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:00:31.626Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"A permissions issue in Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS may allow an app to modify protected system files. The issue is fixed in versions 27 and later, or macOS 15.8 and later, or macOS 26.7 and later. An app may be able to exploit this weakness with local access.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:43:55.479Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-84609"}]}}