Apple security content for iOS/iPadOS 26.7 (support 149041, released 14 September 2026) and macOS Golden Gate 27 (149035) lists CVE-2026-86869 in ImageIO: out-of-bounds write addressed with improved bounds checking; Apple impact text on 26.7 is “Processing a maliciously crafted image may lead to unexpected app termination” (credits: Niels Hofmans, Meta Red Team X, Geonha Lee, Chris Bailey — Short Circuit).

UPDATE 26 Sep 2026: ironPeak blog EX-ARRR publishes full technical disclosure — heap overflow in libAppleEXR.dylib / CompressedInterleave4 when decoding crafted OpenEXR; researcher states Apple triage classified the report as 0-click code execution via iMessage EXR image payload, with BlastDoor not decoding EXR and Spotlight/ImageIO thumbnailing providing the side-door reach; PAC/MIE still constrain reliable exploitation on modern Apple silicon.

Reported May 2026; fixed across iOS/iPadOS/macOS 27 family builds as CVE-2026-86869 per researcher timeline. No CVSS from Apple. Patch: current iOS/iPadOS 26.7+ / macOS 27 (Golden Gate) / equivalent trains. Distinct from bulk desk card apple-ios27-20260914 (does not spotlight this CVE).

Primary: Apple iOS 26.7 security content; technical write-up: ironPeak.