CVE-2026-112642 in iOS
Summary
by MITRE • 10/26/2026
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted font may result in the disclosure of process memory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability described constitutes an out-of-bounds read condition within the system's font processing subsystem, specifically affecting how data is accessed during the parsing and rendering of typeface files. This flaw arises from insufficient validation of array indices or buffer boundaries when interpreting maliciously crafted font structures. In a typical execution flow, the application allocates memory for font metrics and glyph data but fails to verify that requested offsets remain within the allocated limits before reading from them. Consequently, an attacker can construct a specially designed font file containing malformed entries that trigger reads beyond the intended memory region. This behavior is classified under CWE-125, which defines out-of-bounds read vulnerabilities where software reads data past the end or before the beginning of the intended buffer.
The operational impact of this vulnerability centers on information disclosure through process memory leakage. When the flawed bounds checking logic executes a read operation outside the designated boundary, it retrieves arbitrary bytes from adjacent memory locations within the same address space. These leaked bytes may contain sensitive information such as stack canaries, heap metadata, pointers to other objects, or even portions of user data if the font processing occurs in a context with elevated privileges. The disclosure of process memory provides attackers with valuable intelligence that can facilitate further exploitation steps, including bypassing security mitigations like Address Space Layout Randomization by leaking base addresses of critical libraries and executables. This aligns with the ATT&CK technique T1082, which involves system information discovery through querying or reading local resources to gather actionable data for subsequent attacks.
The issue has been addressed in multiple recent operating system releases across Apple's ecosystem, including iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, and visionOS 27.2. The fix implements improved bounds checking mechanisms that rigorously validate all memory access requests against the actual size of allocated buffers before execution. This ensures that any attempt to read data from invalid offsets results in a controlled error or termination rather than an unauthorized memory read. Developers integrating font rendering libraries should ensure they are using versions patched with these security updates and consider implementing additional defensive coding practices such as sanitizing input sources and employing static analysis tools to detect similar boundary violations during the software development lifecycle.