CVE-2026-112479 in iOS
Summary
by MITRE • 10/26/2026
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious USB device may be able to cause unexpected system termination or read kernel memory.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability described constitutes a critical out-of-bounds read flaw within the operating system's handling of Universal Serial Bus devices, specifically affecting iOS, iPadOS, macOS Golden Gate, macOS Sequoia, and macOS Tahoe versions prior to their respective patched releases. This type of memory safety error occurs when software reads data from a memory location that lies outside the intended buffer boundary, typically due to insufficient validation of input parameters or array indices provided by external hardware interfaces. In this specific instance, the flaw resides in the kernel-level drivers responsible for communicating with USB peripherals, where the system fails to properly verify the length and validity of data structures received from connected devices before processing them.
From a technical perspective, an out-of-bounds read allows a malicious actor who has physical access to the device's port or can spoof a hardware interface via a compromised peripheral to trigger unauthorized memory accesses. When a malicious USB device sends specially crafted requests that exceed expected bounds, the operating system may attempt to retrieve data from adjacent memory regions rather than halting with an error. This behavior leads directly to two primary operational impacts: unexpected system termination and potential kernel memory disclosure. The former manifests as a denial of service condition where the affected process or entire system crashes due to accessing invalid memory addresses, while the latter poses a severe confidentiality risk by leaking sensitive information stored in adjacent kernel space, such as cryptographic keys, session tokens, or other privileged data structures that are not intended for user-space consumption.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-125, which defines out-of-bounds read errors resulting from improper validation of array indices or buffer lengths. Furthermore, the exploitation vector relates to ATT&CK technique T1059, specifically command and script interpretation through peripheral devices, although in this case, the immediate impact is more focused on system stability and information leakage rather than direct code execution. The ability to read kernel memory significantly escalates the severity of the issue because it can facilitate further privilege escalation attacks or aid in bypassing security controls like Kernel Address Space Layout Randomization by leaking address space layout information.
Mitigation for this vulnerability requires immediate patching of all affected operating system versions, including iOS 26.7.2 and iPadOS 26.7.2, as well as the macOS variants listed above. Organizations should enforce strict physical security policies to prevent unauthorized USB device connections in high-security environments. Additionally, implementing hardware-based access controls such as USB port blocking or using only certified peripherals can reduce the attack surface. Developers integrating custom drivers must ensure rigorous bounds checking and input validation protocols are implemented during the design phase to prevent similar memory safety issues from recurring in future updates.