CVE-2026-112620
Apple Ipados: improper input validation
- Risk score
- 53/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 26 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2. An attacker in a privileged network position may be able to cause a denial-of-service.
- Affected
- Apple Ipados
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Apple Ipados: Amber, patch this week. A memory corruption issue was addressed with improved memory handling. An attacker could cause an unexpected app termination or arbitrary code execution by parsing a file.
The flaws
- CVE-2026-112620: Improper input validation (CVSS 7.5 · EPSS 0%)
- CVE-2026-112688: Memory corruption can lead to remote code execution (CVSS 8.8 · EPSS 1%)
- CVE-2026-112671: Denial of service (CVSS 7.5 · EPSS 1%)
- CVE-2026-112476: Out-of-bounds read (CVSS 7.5 · EPSS 1%)
The fix
Fix: Check the linked advisory for the concrete fix, as it is not specified in the record.
Who is exposed: {'products': ['iOS', 'iPadOS', 'macOS Golden Gate', 'macOS Sequoia', 'macOS Tahoe'], 'packages': [], 'versions': ['iOS 26.7', 'iPadOS 26.7', 'iOS 27.2', 'iPadOS 27.2', 'macOS Golden Gate 27.2', 'macOS Sequoia 15.8.2', 'macOS Tahoe 26.7.2']}
Where it stands
- No known exploitation
Connects to
- Same weakness: Memory corruption (CWE-119). 341 other warnings in 30 days
- Same product: Earlier Apple Ipados warnings. 127 in the last 90 days
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2. An attacker in a privileged network position may be able to cause a denial-of-service.
Last activity 26 Oct 2026. Patch Forecast updates every hour.