CVE-2026-84598

HighCVSS 7.5/10Last modified Sep 16, 2026

Description

A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Sep 14, 2026
Last modified
Sep 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-845997.8The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS GoldCVE-2026-846005.4An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOSCVE-2026-846015.5A permissions issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass CVE-2026-846025.5A type confusion issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS GoldCVE-2026-846035.5A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27, watchOS 27. An appCVE-2026-846047.8A stack buffer overflow was addressed through improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, CVE-2026-846053.3An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOCVE-2026-846067.5A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visiCVE-2026-846077.8A race condition was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS CVE-2026-846099.8A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS SeCVE-2026-84618.8An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in CVE-2026-846105.5A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Taho
CVE-2026-84598: High severity, CVSS 7.5 | Vulnix