CVE-2026-84596
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font may result in the disclosure of process memory.
- Published Sep 14, 2026
- CVSS 6.5 medium
- 0.4% chance of exploitation in the next 30 days (EPSS)
- A fix is available