Live › vulnerability › CVE-2022-26704
Apple's watchOS 27.2 fixes a Spotlight flaw in how symlinks were validated, which let an app gain elevated privileges on the watch. The same release also fixes many kernel, media, WebKit and other flaws, several of which let an app crash the system or corrupt memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 04:33 UTC, 0h before NVD. All times on this page are UTC.
The advisory lists the fixes for Apple Watch Series 9 and later. The Spotlight entry requires a malicious app already installed on the watch, so the exposure is local to the device. Teams that do not manage Apple Watches can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apple mac os x | vendor | >= 10.15, < 10.15.7 | 10.15.7 |
| apple mac os x | vendor | = 10.15.7 | – |
| apple macos | vendor | >= 11.0, < 11.6.8 | 11.6.8 |
| apple macos | vendor | >= 12.0.0, < 12.4 | 12.4 |
Unknown from the sources.
27.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
About the security content of watchOS 27.2 - Apple Support
This document describes the security content of watchOS 27.2.
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
Released October 26, 2026
Available for: Apple Watch Series 9 and later
Impact: A malicious application may be able to bypass Privacy preferences
Description: A logging issue was addressed with improved data redaction.
CVE-2026-113898: Bhaswanth Chigurupati
Available for: Apple Watch Series 9 and later
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with additional entitlement checks.
CVE-2026-112446: LiangWei, Sindre Sorhus
Available for: Apple Watch Series 9 and later
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with additional entitlement checks.
CVE-2026-112692: Huy Nguyen (@34306) of Calif.io
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-112454: @Licht_jb, Hcamael and 章鱼哥@aipy (aipyaipy.com)
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted file may lead to unexpected app termination
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2026-112546: lunar815, Surej Sekhar, Piotr Jerzy Duszynski, r3pwnx (@r3pwnx), an anonymous researcher, Lily Cohl (@GenericCoding), Nathaniel Oh (@calysteon)
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination or corrupt kernel memory
Description: An out-of-bounds write issue was addressed with improved bounds checking.
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination or read kernel memory
Description: An out-of-bounds read was addressed with improved input validation.
Available for: Apple Watch Series 9 and later
Impact: An attacker in physical proximity may be able to cause a denial-of-service
Description: A null pointer dereference was addressed with improved validation.
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with additional restrictions.
CVE-2026-112678: Neon, Niels Hofmans, Mustafa Calap (@ordinal0, dbg.re)
Impact: Processing a maliciously crafted calendar invitation may lead to memory corruption
Description: An out-of-bounds write issue was addressed with improved bounds checking.
Available for: Apple Watch Series 9 and later
Impact: Processing a maliciously crafted image may result in disclosure of process memory
Description: The issue was addressed with improved checks.
CVE-2026-86988: Mateusz Jurczyk of Google Project Zero, Meta Red Team X - Nik Tsytsarkin
Available for: Apple Watch Series 9 and later
Impact: An app may be able to disclose kernel memory
Description: A memory initialization issue was addressed with improved memory handling.
Impact: An app may be able to cause unexpected system termination or corrupt process memory
Description: A buffer overflow issue was addressed with improved memory handling.
Impact: Processing a maliciously crafted audio file may lead to memory corruption
Description: A buffer overflow was addressed with improved size validation.
CVE-2026-86972: an anonymous researcher, Meta Product Security
Impact: An attacker in radio range may be able to cause unexpected system termination
Description: A heap buffer overflow was addressed with improved bounds checking.
CVE-2026-112638: Përparim Mjeku, Altin Gashi, Altin Gashi
Impact: Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-113950: Substrate, Stefan Esser (Calif)
Impact: Processing a maliciously crafted video file may lead to unexpected app termination
Description: The issue was addressed with improved memory handling.
Description: A permissions issue was addressed with additional restrictions.
CVE-2026-112706: Adriatik Raci, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Chris Bailey - Short Circuit
Impact: Processing a maliciously crafted font may result in the disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds checking.
Description: An out-of-bounds read was addressed with improved input validation.
Impact: An attacker in a privileged network position may be able to impersonate a Kerberos KDC
Description: An issue with signature validation was addressed with improved checks.
CVE-2026-112518: Roman Zabicki, Tristan Madani (@TristanInSec) from Talence Security
Impact: Processing a maliciously crafted video file may lead to unexpected system termination
Description: An integer overflow was addressed with improved bounds checking.
Description: A memory initialization issue was addressed with improved memory handling.
CVE-2026-112571: sh3rlock (김보겸)
Description: An out-of-bounds read was addressed with improved bounds checking.
Impact: An attacker may be able to cause unexpected system termination or read kernel memory
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2026-112515: Charles Stevenson, Seung Je Seong, Mathis Mansière
Impact: A buffer overflow may result in memory corruption and unexpected app termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
Impact: An app may be able to cause unexpected system termination or corrupt kernel memory
Description: A race condition was addressed with improved state handling.
CVE-2026-112459: Lily Cohl (@GenericCoding), an anonymous researcher
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination or corrupt kernel memory
Description: A race condition was addressed with improved locking.
CVE-2026-112477: an anonymous researcher
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected changes to copy-on-write memory
Description: A memory integrity issue was addressed with improved handling of copy-on-write pages.
CVE-2026-112576: Pedro Pinho
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory handling.
CVE-2026-112606: Wang Yu
Available for: Apple Watch Series 9 and later
Impact: An app may be able to cause unexpected system termination or corrupt kernel memory
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-65350: Nebula Security (@nebusecurity), Tim Michaud (@TimGMichaud) of Aginor.ai, Xinru Chi of Pangu Lab
CVE-2026-112679: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.
Available for: Apple Watch Series 9 and la
This page as .md · .json · in your agent: get_signal("CVE-2022-26704")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.