iOS and iPadOS CVE-2026-86921

Exploitation requires local code execution on the device - specifically, an attacker-controlled or malicious app process running on iOS/iPadOS (before 26.7, and the 27 line), macOS (before 27), or visionOS (before 27). The flaw is a permissions-validation weakness (CWE-269) that lets such a local process overwrite files it should not have write access to. Limiting factors: there is no remote vector (AV:L), so the attacker must first get code onto the device (e.g., via App Store sideloading, a malicious app, or chaining from another bug); impact is confined to integrity (file overwrite), with no direct confidentiality or availability loss per the CVSS vector. Patched OS versions fully remediate the issue.

This is a genuine but moderate-priority issue rather than an urgent emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, score 6.2) indicates a LOCAL attack vector with low complexity and no privileges or user interaction required, impacting integrity only (ability to overwrite restricted files) with no confidentiality or availability loss. Because the vector is AV:L, exploitation requires the attacker to already be running code on the device (e.g., a malicious or compromised app), which substantially limits remote mass-exploitation potential. No EPSS score was provided, so exploitation-probability modeling cannot be incorporated. The CVE is NOT listed in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis - do not treat this as actively exploited. The SSVC framework cannot be fully applied (no automatable/exploitation-status data supplied), but the local vector implies exploitation is not automatable at scale. Net: a real, fixable integrity/privilege flaw worth patching in normal cycles given Apple's enormous install base, but not a drop-everything issue absent evidence of exploitation.

A user installs or is tricked into running a malicious application on an iPhone, iPad, Mac, or Vision Pro device. The app abuses the improper permission validation to write to or overwrite files that should be restricted from it, potentially corrupting protected data or tampering with privileged configuration. No public exploit code is known, and the attacker must already have local code execution on the device.