CVE-2026-112413 in iOS
Summary
by MITRE • 10/26/2026
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted file may lead to unexpected app termination.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability addressed in this update is classified as an out-of-bounds read, which corresponds to CWE-125 in the Common Weakness Enumeration standard. This type of flaw occurs when software attempts to read data from a memory location that lies outside the boundaries of the intended buffer or array. In the context of Apple's operating systems, including iOS, iPadOS, macOS, and visionOS, such vulnerabilities typically arise within system frameworks responsible for parsing complex file formats or processing multimedia content. The root cause is insufficient validation of input parameters before accessing memory structures, allowing a maliciously crafted file to trigger access to unauthorized memory regions.
From an operational perspective, the primary impact of this vulnerability is denial of service through application termination. When a user processes a specially constructed file designed to exploit the bounds checking deficiency, the operating system's security mechanisms detect the illegal memory access and forcibly terminate the affected process to prevent further exploitation or data corruption. While immediate code execution is not guaranteed by an out-of-bounds read alone, such conditions can sometimes lead to information disclosure if sensitive data residing in adjacent memory locations is leaked before termination occurs. This behavior aligns with ATT&CK technique T1083, which covers file and directory discovery, as the vulnerability may be leveraged during reconnaissance phases where attackers probe systems for exploitable weaknesses through crafted inputs.
The remediation involves implementing stricter bounds checking logic within the affected components to ensure that all memory accesses remain within allocated limits. This fix has been deployed across multiple recent versions of Apple's ecosystem, specifically iOS 26.7.2 and iPadOS 26.7.2, as well as iOS 27.2 and iPadOS 27.2. For desktop environments, the patch is available in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. Additionally, visionOS 27.2 includes this security update to protect augmented reality devices from similar attacks.
To mitigate risks associated with such vulnerabilities, users should ensure their devices are updated to the latest supported software versions immediately upon release of these patches. Security best practices also include avoiding opening files from untrusted sources and utilizing sandboxing environments where possible to limit the potential impact of any successful exploitation attempts. Organizations managing enterprise deployments should prioritize patch management strategies that incorporate these specific version updates to maintain a secure posture against file-based attack vectors targeting memory safety flaws.