Here’s every security fix included in iOS 27 and iPadOS 27

Apple announced today that iOS 27 and iPadOS 27 are now available, bringing more than 120 vulnerability mitigations to the latest iPhone and iPad lineup. The updates coincide with security releases for macOS 27, macOS 26.7, and macOS 15.8, marking a coordinated effort across Apple’s ecosystem for 2027.

Background

The security content page for the new mobile releases details a broad set of patches that address code execution, privilege escalation, data leakage, and sandbox bypasses. Each fix targets a specific framework, service, or driver that underpins the operating system’s core functionality. By publishing the CVE identifiers, Apple provides transparency and credit to the independent researchers who discovered the flaws.

Scope of the Updates

The rollout applies to all devices that support iPhone 11 and later, as well as a wide range of iPad models including iPad Pro 12.9‑inch 4th generation and later, iPad Pro 11‑inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. Each component description lists the exact impact, the remediation technique, and the associated CVE‑2026 identifier.

Detailed Vulnerabilities

Accelerate Framework – Available for the full device list above. Processing a maliciously crafted image could cause unexpected process termination. The issue stemmed from an out‑of‑bounds write and was fixed with tighter bounds checking. CVE‑2026‑86882.

Accessibility (Data Protection) – Same device coverage. An app could previously access sensitive user data. Apple introduced improved data protection mechanisms to block the vector. CVE‑2026‑43664.

Accessibility (App Enumeration) – Same device coverage. An app could identify other installed apps on the device, compromising privacy. The fix adds stricter handling of user preferences. CVE‑2026‑64761.

Accounts – Same device coverage. A malicious app could bypass privacy preferences, potentially exposing account information. Apple corrected the authorization flow with enhanced state management. CVE‑2026‑65404.

APFS – Same device coverage. An app could trigger unexpected system termination or write to kernel memory via an out‑of‑bounds write. The patch adds rigorous bounds checking. CVE‑2026‑84523.

App Store – Same device coverage. A local app could read a persistent account identifier, leaking identity data. Additional permission restrictions were introduced. CVE‑2026‑86888.

Apple Account – Same device coverage. An app could misuse the Sign In With Apple flow to access the user’s Apple account. Improved state management now blocks the exploit. CVE‑2026‑20683.

Apple Neural Engine – Same device coverage. An integer overflow could cause unexpected system termination. Input validation was strengthened to prevent the overflow. CVE‑2026‑65408.

AppleAVD – Same device coverage. A use‑after‑free condition could terminate the system unexpectedly. Memory management was revised to eliminate the dangling pointer. CVE‑2026‑65407.

AppleDouble – Same device coverage. Mounting a disk image with malicious files could crash the system. Bounds checking was improved to stop the out‑of‑bounds write. CVE‑2026‑84519.

AppleKeyStore – Same device coverage. A use‑after‑free bug could cause unexpected termination. The fix adds safer memory handling. CVE‑2026‑84593.

Authentication Services – Same device coverage. An app could delete credentials stored in the Keychain. Apple removed the vulnerable code path entirely. CVE‑2026‑86905.

AuthKit – Same device coverage. A local app could read a persistent account identifier. Permissions were tightened with additional restrictions. CVE‑2026‑84583.

AVEVideoEncoder (Checks) – Same device coverage. An app could cause unexpected termination. The issue was resolved by adding comprehensive checks. CVE‑2026‑65410.

AVEVideoEncoder (Type Confusion) – Same device coverage. A type confusion could lead to unexpected termination. Memory handling was improved to prevent the confusion. CVE‑2026‑84616.

AVEVideoEncoder (Race Condition) – Same device coverage. A sandboxed app could execute arbitrary code with kernel privileges. State management was hardened to eliminate the race. CVE‑2026‑84607.

BackgroundAssets – Same device coverage. An app could access sensitive user data via a logic flaw. Validation logic was reinforced to block the leak. CVE‑2026‑65406.

Baseband (Termination) – Available for iPhone 11 and later. An attacker within radio range could cause unexpected termination. Input validation was tightened. CVE‑2026‑86885.

Baseband (Denial‑of‑Service) – Same device coverage. A remote attacker could trigger a denial‑of‑service. Improved input validation mitigates the condition. CVE‑2026‑86879.

Bluetooth (Code Execution) – Full device coverage. A remote attacker could cause app termination or arbitrary code execution via an out‑of‑bounds write. Bounds checking was reinforced. CVE‑2026‑65414.

Bluetooth (Unauthorized Access) – Full device coverage. An app could gain unauthorized Bluetooth access. Authorization handling was updated with stricter state management. CVE‑2026‑84560.

Camera – Full device coverage. An app could access sensitive user data through a permissions flaw. Additional restrictions now protect camera resources. CVE‑2026‑86878.

CloudKit (Account ID) – Full device coverage. A local app could read a persistent account identifier. State management was improved to conceal the identifier. CVE‑2026‑86895.

CloudKit (Device Name) – Full device coverage. An app could read the device name via a permissions issue. New restrictions block the disclosure. CVE‑2026‑86893.

copyfile – Full device coverage. An archive could bypass Gatekeeper quarantine. Additional file checks now enforce quarantine compliance. CVE‑2026‑65399.

CoreMedia (Arbitrary Code) – Full device coverage. Processing a malicious image could lead to arbitrary code execution. The vulnerable code was removed to eliminate the risk. CVE‑2026‑64752.

CoreMedia (Sandbox Bypass) – Full device coverage. A sandboxed process could circumvent restrictions via an out‑of‑bounds write. Bounds checking was tightened. CVE‑2026‑86876.

CoreMedia (Video Crash) – Full device coverage. A crafted video could cause unexpected termination. The out‑of‑bounds write was patched with stricter checks. CVE‑2026‑65344.

CoreML – Full device coverage. A sandboxed app could access restricted files due to a permissions flaw. Path validation was enhanced to block unauthorized reads. CVE‑2026‑84624.

CoreMotion – Full device coverage. An app could read motion data from headphones without consent. Authorization validation was improved. CVE‑2026‑43737.

CoreText (Denial‑of‑Service) – Full device coverage. Processing web content could trigger a denial‑of‑service via a null pointer dereference. Input validation now catches the condition. CVE‑2026‑65412.

CoreText (Memory Disclosure) – Full device coverage. A malicious font could disclose process memory through an out‑of‑bounds read. Bounds checking was reinforced. CVE‑2026‑84596.

CoreUI – Available for the same iPhone and iPad models (list truncated in source).

Impact and Mitigations

Collectively, the patches address a spectrum of attack vectors ranging from local privilege escalation to remote code execution. By tightening bounds checking, improving input validation, and enforcing stricter permission models, Apple reduces the attack surface across its mobile platforms. Users are encouraged to install iOS 27 and iPadOS 27 promptly to benefit from these defenses.

Conclusion

The iOS 27 and iPadOS 27 releases represent one of the most extensive security updates in Apple’s recent history, with over 120 CVE‑identified issues resolved. The breadth of components patched—spanning graphics, storage, networking, and machine‑learning subsystems—demonstrates Apple’s commitment to safeguarding user data and device integrity throughout 2027. Prompt adoption ensures that iPhone and iPad users remain protected against both known and emerging threats.