CVE-2026-112656 in iOS
Summary
by MITRE • 10/26/2026
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted font may result in the disclosure of process memory.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability described involves an out-of-bounds read condition within the system's font processing subsystem, specifically triggered by malformed or maliciously constructed font files. This type of flaw typically arises when software fails to properly validate the length or boundaries of data structures before accessing them in memory. In this instance, the underlying issue was addressed through improved bounds checking mechanisms, ensuring that any attempt to read from a buffer exceeds its allocated limits is intercepted and prevented by the operating system's security controls. The root cause aligns with CWE-125, which defines out-of-bounds read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. Such errors are particularly dangerous in high-level applications like font renderers because they often operate on untrusted input from external sources, such as downloaded documents or web content containing embedded fonts.
The operational impact of this vulnerability is significant due to its potential for information disclosure. When a maliciously crafted font is processed by the affected iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions, it can cause the application handling the font data to read memory locations that do not belong to the intended buffer. This unauthorized access allows an attacker to extract sensitive data residing in adjacent memory spaces of the process. The disclosed information may include cryptographic keys, session tokens, passwords, or other private user data currently held in RAM by the affected application. Because this occurs during routine processing tasks like rendering text or displaying documents, it can be exploited remotely without requiring any special privileges from the victim beyond opening a malicious file or visiting a compromised website that hosts such fonts.
From a threat modeling perspective, this vulnerability maps to MITRE ATT&CK technique T1005, which covers Data from Local System Retrieval via Memory Scraping. Attackers can leverage this flaw as part of a broader exploitation chain to gather intelligence about the victim's environment or credentials stored in memory. The fact that multiple Apple operating systems are affected indicates a shared codebase component responsible for font parsing and rendering across their ecosystem, increasing the attack surface significantly. Users who frequently open documents from untrusted sources or browse websites with rich media content are at higher risk of encountering such maliciously crafted fonts designed to trigger this specific memory access violation.
Mitigation strategies primarily rely on applying the provided software updates that contain the fix for improved bounds checking. For end-users, it is critical to ensure that all devices running iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are updated to the specified patched versions: iOS 26.7.2 or later, iPadOS 26.7.2 or later, macOS Golden Gate 27.2 or later, macOS Sequoia 15.8.2 or later, macOS Tahoe 26.7.2 or later, tvOS 27.2 or later, visionOS 27.2 or later, and watchOS 27.2 or later. These updates implement stricter validation logic that prevents the out-of-bounds memory access from occurring in the first place. Additionally, organizations should enforce policies that restrict the execution of untrusted code and encourage users to avoid opening documents from unknown sources until they can verify their safety using updated security software. Regular patch management cycles are essential to maintain defense against such low-level memory corruption vulnerabilities that continue to pose a serious threat to system integrity and data confidentiality.