CVE-2026-112607
Apple Ipados: out-of-bounds read can lead to information disclosure
- Risk score
- 59/100
- CVSS
- 8.2 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 26 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2. A remote attacker may be able to leak memory.
- Affected
- Apple Ipados
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Apple Ipados: Amber, patch this week. A memory corruption issue was addressed with improved memory handling. An attacker could cause an unexpected app termination or arbitrary code execution by parsing a file.
The flaws
- CVE-2026-112607: Out-of-bounds read can lead to information disclosure (CVSS 8.2 · EPSS 0%)
- CVE-2026-112688: Memory corruption can lead to remote code execution (CVSS 8.8 · EPSS 1%)
- CVE-2026-112671: Denial of service (CVSS 7.5 · EPSS 1%)
- CVE-2026-112476: Out-of-bounds read (CVSS 7.5 · EPSS 1%)
The fix
Fix: Check the linked advisory for the concrete fix, as it is not specified in the record.
Who is exposed: {'products': ['iOS', 'iPadOS', 'macOS Golden Gate', 'macOS Sequoia', 'macOS Tahoe'], 'packages': [], 'versions': ['iOS 26.7', 'iPadOS 26.7', 'iOS 27.2', 'iPadOS 27.2', 'macOS Golden Gate 27.2', 'macOS Sequoia 15.8.2', 'macOS Tahoe 26.7.2']}
Where it stands
- No known exploitation
Connects to
- Same weakness: Out-of-bounds read (CWE-125). 399 other warnings in 30 days
- Same product: Earlier Apple Ipados warnings. 127 in the last 90 days
Why it is Yellow
- CVSS 8.2 high
- Remotely exploitable without logging in
References
Original description
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2. A remote attacker may be able to leak memory.
Last activity 26 Oct 2026. Patch Forecast updates every hour.