Five Apple CVEs, and what actually broke

A Mac helper could refuse an authorization request and still hand out private-key material through an operation that skipped the check. An image could crash a decoding service while my test phone stayed locked. A display component checked its arithmetic and then used a number that did not belong in its array.

Apple’s September 14, 2026 security releases credit me, Chris Bailey of Short Circuit, in five CVE entries covering CoreMedia, IOMobileFrameBuffer, ImageIO, Keychain Access and WebDAV. The investigations below follow the actual tests and the failures they established.

Apple’s September macOS advisory includes all five CVE entries

CoreMedia: the wrong count, followed by half a boundary check

CoreMedia sits beneath the visible business of playing and managing media. My report concerned a service inside Apple’s media playback process that an ordinary sandboxed app could reach. One part allocated memory using a total item count, then filled it according to a different count. Another checked whether an array position was below the upper limit without checking whether it was negative. Both numbers looked acceptable to the particular check inspecting them. Together they let an app affect memory in a different process.

I ran the same setup twice, changing only whether the final writes happened. Without them, the expected notifications never arrived. With them, the service sent four notifications identifying the neighboring objects I had intended to alter, and it kept running. A separate crashing test put a chosen value into a processor register. I did not turn either result into code execution or a completed sandbox escape. Apple’s public impact for CVE-2026-86876 concerns a potential breach of sandbox restrictions, addressed with improved bounds checking.

Apple credits Chris Bailey - Short Circuit.

Read the CoreMedia investigation: how two counting mistakes reached neighboring memory

IOMobileFrameBuffer: valid arithmetic, invalid destination

The display stack contains code that runs in the kernel, the privileged core of the operating system. My IOMobileFrameBuffer report started with an app-controlled array index that reached that code without the necessary boundary check. Protection against arithmetic overflow existed. Protection against selecting an entry outside this particular array did not. A nearby operation showed that the implementation could do both checks when it remembered to.

On the tested iPhone beta, kernel panic records supported the out-of-bounds access and showed values I controlled in the resulting processor state. Separate tests reached a faulting memory read, but returned no kernel contents to the app. The results also varied between attempts. On the tested Mac, access to the affected operation was rejected before it ran. That difference belongs in the story even though Apple lists CVE-2026-65398 in fixes for several platforms.

Apple credits Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0, dbg.re), David Strnadel, Meta Red Team X - Nik Tsytsarkin.

Read the framebuffer investigation: what the kernel faults proved

ImageIO: the phone did not need me to open the picture

An animated image needs more than pixels. It describes where each frame belongs on a canvas, and the decoder has to establish that those instructions fit. The ImageIO report traced a failure across two stages of that work: preliminary parsing could accept malformed frame information, and a later numerical comparison treated an invalid position as acceptable. The resulting copy went outside its destination.

In the documented Messages test, the receiving iPhone stayed locked and untouched while a service responsible for processing an unknown sender’s message decoded the image and crashed. The captured processor state contained my chosen value. That establishes a result without recipient interaction under those test conditions, not a phone takeover. Other paths involved browser rendering, opened mail and thumbnails; they had their own interaction requirements.

My comparison covered particular development builds and earlier implementations. Apple’s correction list includes macOS Golden Gate 27 and iOS 26.7 / iPadOS 26.7. Those advisory entries provide the public release coverage for CVE-2026-86869; the narrower experiments do not establish its status on every other build.

Apple credits Chris Bailey - Short Circuit, Meta Red Team X, Niels Hofmans, Geonha Lee (@leegn4a).

Read the ImageIO investigation: an image, a locked phone and a controlled crash

Keychain Access: the check worked when anyone bothered to call it

A private key is supposed to let its owner prove an identity without handing the secret to whoever asks. My Keychain Access report documented a privileged helper doing exactly the wrong part: exporting private-key material to a local process without the required authorization. The permission machinery was present and capable of refusing access. The affected export operation omitted it.

I checked the exported material against the corresponding public certificates to establish what had actually come back. A separate test on a beta Mac reproduced the export from a low-privilege account. This was an access-control failure involving an unsandboxed local process, not a break in the underlying cryptography or a demonstration that every password on a Mac could be stolen. Apple addressed CVE-2026-84556 with improved access control.

Apple credits Adrián Díaz Aguilar, Chris Bailey - Short Circuit, Peter Malone, HvxyZLF.

Read the Keychain investigation: private keys through a route that skipped permission

WebDAV: a failed folder listing was only the start of the evidence

WebDAV lets a remote server expose files and folders through a familiar filesystem interface. That familiarity does not make its replies trustworthy. My report concerned the Mac agent parsing a server’s directory response. It checked the length of one piece of incoming text, then later derived a different, larger length for a copy. The earlier check did not constrain the copy that damaged memory.

Both of the input families I compared made the folder listing fail. Only one killed the agent and produced a crash report. A model of the affected processing demonstrated chosen bytes beyond the destination, while the live tests established the service failure. I did not demonstrate those bytes landing on a chosen neighboring object in the real agent. Connecting to the malicious share was also a prerequisite; receiving an ordinary web link did not reproduce the attack.

Apple addressed CVE-2026-43677 by removing the vulnerable code. That statement does not say Apple removed WebDAV altogether. The credit list below reflects the current advisory, including its October update.

Apple credits Joseph Semaan, bubu, Omar Cerrito, HE WEI (ギカク), Roman Zabicki, Richard Zana, Chris Bailey - Short Circuit, Aswin Kumar Gokulakannan, Surya Narayan Kushwaha, Bruce Dang of Calif.io in collaboration with Claude and Anthropic Research.

Read the WebDAV investigation: why a listing error and a crashed service are different results

The acknowledgments, the updates and the people doing the fixing

Apple also acknowledges my assistance with CoreMedia in the iOS 27 / iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27 and visionOS 27 advisories. The iOS 27 / iPadOS 27 page has a separate CoreText acknowledgment naming Chris Bailey - Short Circuit, Jian Lee (@speedyfriend433) and shobhit srivastav. Those entries have no CVE identifier attached and are not additional vulnerabilities in this count.

Read the additional acknowledgments in Apple’s iOS 27 / iPadOS 27 advisory

Across the five CVEs, the September fixes span iOS 27 / iPadOS 27, iOS 26.7 / iPadOS 26.7, macOS Golden Gate 27, macOS Tahoe 26.7, macOS Sequoia 15.8, watchOS 27, tvOS 27 and visionOS 27. That is the combined release list, not a claim that every bug affected every device. Each article links the advisories for its particular CVE. For a device you use now, install the current supported update rather than aiming for an old version number merely because it appears in a research article.

Thank you to Apple’s security and engineering teams for addressing these reports and crediting the work, and to the other researchers named alongside me.

Read the later series: seven October Apple CVEs, including two Bluetooth credits

Apple’s advisories checked October 26, 2026. This overview was expanded to accompany the five individual research articles.