CVE-2026-86919
8.8HighPublished 20 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-121
Impact
Attackers can execute arbitrary code on the target system. They require a pre-paired Bluetooth device within wireless range.
Root cause
A stack-based buffer overflow resulting from improper input validation.
Affected systems
iOS and iPadOS prior to 26.7 and 27, macOS Golden Gate prior to 27, macOS Sequoia prior to 15.8, macOS Tahoe prior to 26.7, and visionOS prior to 27.
CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Update to iOS/iPadOS 26.7, iOS/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, or visionOS 27. As an interim mitigation, unpair untrusted Bluetooth accessories or disable Bluetooth.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code.