{"id":"CVE-2022-26704","kind":"vulnerability","aliases":["CVE-2022-26704"],"related":[],"title":"A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks","description":"About the security content of watchOS 27.2 - Apple Support\n\n# About the security content of watchOS 27.2\n\nThis document describes the security content of watchOS 27.2.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## watchOS 27.2\n\nReleased October 26, 2026\n\n### Accounts\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: A logging issue was addressed with improved data redaction.\n\nCVE-2026-113898: Bhaswanth Chigurupati\n\n### Accounts\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with additional entitlement checks.\n\nCVE-2026-112446: LiangWei, Sindre Sorhus\n\n### App Intents\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with additional entitlement checks.\n\nCVE-2026-112692: Huy Nguyen (@34306) of Calif.io\n\n### AppleAVD\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-112454: @Licht_jb, Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### Audio\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112546: lunar815, Surej Sekhar, Piotr Jerzy Duszynski, r3pwnx (@r3pwnx), an anonymous researcher, Lily Cohl (@GenericCoding), Nathaniel Oh (@calysteon)\n\n### AVEVideoEncoder\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### AVEVideoEncoder\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\n### Bluetooth\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An attacker in physical proximity may be able to cause a denial-of-service\n\nDescription: A null pointer dereference was addressed with improved validation.\n\n### Calendar\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112678: Neon, Niels Hofmans, Mustafa Calap (@ordinal0, dbg.re)\n\n### Calendar\n\nImpact: Processing a maliciously crafted calendar invitation may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### ColorSync\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: Processing a maliciously crafted image may result in disclosure of process memory\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-86988: Mateusz Jurczyk of Google Project Zero, Meta Red Team X - Nik Tsytsarkin\n\n### Compression\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\n### CoreAudio\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: A buffer overflow issue was addressed with improved memory handling.\n\n### CoreAudio\n\nImpact: Processing a maliciously crafted audio file may lead to memory corruption\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-86972: an anonymous researcher, Meta Product Security\n\n### CoreAudio\n\nImpact: An attacker in radio range may be able to cause unexpected system termination\n\nDescription: A heap buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112638: Përparim Mjeku, Altin Gashi, Altin Gashi\n\n### CoreGraphics\n\nImpact: Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-113950: Substrate, Stefan Esser (Calif)\n\n### CoreMedia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: The issue was addressed with improved memory handling.\n\n### CoreMedia\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112706: Adriatik Raci, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Chris Bailey - Short Circuit\n\n### CoreText\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\n### FontParser\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\n### FontParser\n\n### Heimdal\n\nImpact: An attacker in a privileged network position may be able to impersonate a Kerberos KDC\n\nDescription: An issue with signature validation was addressed with improved checks.\n\nCVE-2026-112518: Roman Zabicki, Tristan Madani (@TristanInSec) from Talence Security\n\n### HomeKit\n\nImpact: Processing a maliciously crafted video file may lead to unexpected system termination\n\nDescription: An integer overflow was addressed with improved bounds checking.\n\n### ImageIO\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-112571: sh3rlock (김보겸)\n\n### ImageIO\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\n### IOHIDFamily\n\nImpact: An attacker may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112515: Charles Stevenson, Seung Je Seong, Mathis Mansière\n\n### IOKit\n\nImpact: A buffer overflow may result in memory corruption and unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### IOMobileFrameBuffer\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-112459: Lily Cohl (@GenericCoding), an anonymous researcher\n\n### IOSurface\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-112477: an anonymous researcher\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected changes to copy-on-write memory\n\nDescription: A memory integrity issue was addressed with improved handling of copy-on-write pages.\n\nCVE-2026-112576: Pedro Pinho\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-112606: Wang Yu\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-65350: Nebula Security (@nebusecurity), Tim Michaud (@TimGMichaud) of Aginor.ai, Xinru Chi of Pangu Lab\n\nCVE-2026-112679: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-112517: Pasquale Scola, Wout van der Ploeg (woutvanderploeg.nl), John Lussier, Cem Onat Karagun, an anonymous researcher\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-112516: greenbynox, an anonymous researcher\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-112514: Marc Newlin of SkySafe, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., greenbynox\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-84495: Wang Yu\n\nCVE-2026-112474: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112476: Arnold Cartagena, Matt Suiche (@msuiche) of Tolmo\n\n### Kernel\n\nImpact: An app may be able to determine kernel memory layout\n\nDescription: An information disclosure issue was addressed with improved state management.\n\n### MediaAnalysis\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-113915: Abodi Dawoud, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Zhongquan Li (@Guluisacat), Ilya Andr (andrd3v) of Positive Technologies\n\n### Messages\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: A remote attacker may be able to cause unexpected app termination\n\nDescription: An input validation issue was addressed with improved input validation.\n\nCVE-2026-112682: Mahmoud Abdelmoniem\n\n### Shortcuts\n\nAvailable for: Apple Watch Series 9 and later\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-112559: Lucas Lammer, Stuart Wallace\n\nCVE-2026-112455: Chris Bailey - Short Circuit, Rahul Raj\n\n### Siri\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-112685: silo, Abodi Dawoud\n\n### Spotlight\n\nImpact: An app may be able to gain elevated privileges\n\nDescription: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.\n\nCVE-2022-26704: Joshua Mason of Mandiant, Gergely Kalman (@gergely_kalman)\n\n### Spotlight\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\n### SwiftUI\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 328114\n\nCVE-2026-113904: Lily Cohl (@GenericCoding), Do Young Park (adawn), MYUNGYONG LEE, Luke Francis (@lukefr09), Shubham Chaskar, Kwak Kiyong, Song Nuri\n\nWebKit Bugzilla: 317465\n\nCVE-2026-112599: Avinash Kumar Thapa & Jay Kaushik Patel\n\n### WebKit\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 322916\n\nCVE-2026-112697: OpenAI Codex Security - Amy Burne","summary":"Apple's watchOS 27.2 fixes a Spotlight flaw in how symlinks were validated, which let an app gain elevated privileges on the watch. The same release also fixes many kernel, media, WebKit and other flaws, several of which let an app crash the system or corrupt memory.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"apple mac os x","fixed":["10.15.7"],"affected":">= 10.15, < 10.15.7","ecosystem":"vendor"},{"name":"apple mac os x","fixed":[],"affected":"= 10.15.7","ecosystem":"vendor"},{"name":"apple macos","fixed":["11.6.8"],"affected":">= 11.0, < 11.6.8","ecosystem":"vendor"},{"name":"apple macos","fixed":["12.4"],"affected":">= 12.0.0, < 12.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","apple-watch","infrastructure","vendor-advisory","watchos"],"not_affected_if":[],"how_to_check":null,"fix":"- watchOS `27.2`","status":"open","published_at":"2022-05-26T19:15:08+00:00","first_seen_at":"2026-10-29T04:33:06+00:00","triaged_at":"2026-10-29T04:34:40+00:00","updated_at":"2026-10-29T04:41:58+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-29T04:34:40Z","model":"claude-haiku-5-5","output":{"fix":"- watchOS `27.2`","reach":"local","title":"watchOS 27.2 update fixes Spotlight flaw letting apps gain elevated privileges","impact":"high","summary":"Apple's watchOS 27.2 fixes a Spotlight flaw in how symlinks were validated, which let an app gain elevated privileges on the watch. The same release also fixes many kernel, media, WebKit and other flaws, several of which let an app crash the system or corrupt memory.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["apple-watch","watchos"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Malicious app gains elevated privileges on the Apple Watch.","analyst_note":"Verify CVE-2022-26704 is the Spotlight symlink entry in https://support.apple.com/en-us/149525; the CVE id is from 2022 while the release is dated 2026.","how_to_check":"unknown","plain_action":"Update your Apple Watch to watchOS 27.2.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The advisory lists the fixes for Apple Watch Series 9 and later. The Spotlight entry requires a malicious app already installed on the watch, so the exposure is local to the device. Teams that do not manage Apple Watches can skip it.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001683,"input_tokens":8590,"output_tokens":1648,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112446':249C '-112454':328C '-112546':372C '-112678':523C '-112692':285C '-113898':215C '-2022':19A,22A '-2026':214C,248C,284C,327C,371C,522C,589C '-26704':20A,23A '-86988':590C '2026':182C '26':181C '27.2':48B,98C,107C,116C,178C '34306':288C '9':189C,224C,260C,297C,342C,396C,434C,471C,564C,609C 'abl':198C,232C,268C,404C,442C,482C,506C,617C,639C 'access':234C,270C,508C 'account':183C,218C 'addit':244C,280C,519C 'address':12A,208C,242C,278C,321C,365C,423C,460C,496C,517C,553C,584C,628C,655C 'advisori':43B 'aipi':334C 'aipyaipy.com':335C 'also':71B 'anonym':382C 'app':61B,85B,229C,253C,265C,311C,355C,401C,439C,503C,614C,636C 'appl':36B,38B,45B,99C,118C,125C,151C,155C,173C,186C,221C,257C,294C,339C,393C,431C,468C,561C,606C 'apple':24A,28A,32A,34A 'apple-watch':37B 'appleavd':291C 'applic':195C 'attack':476C 'audio':336C,666C 'avail':144C,184C,219C,255C,292C,337C,391C,429C,466C,559C,604C 'avevideoencod':390C,428C 'bhaswanth':216C 'bluetooth':465C 'bound':362C,368C,419C,426C,457C,549C,556C 'buffer':651C 'bypass':200C 'calap':528C 'calendar':500C,531C,537C 'calif.io':290C 'calysteon':389C 'caus':406C,444C,484C,641C 'check':246C,282C,369C,427C,557C,587C 'chigurupati':217C 'cohl':385C 'colorsync':558C 'compress':603C 'confirm':131C 'content':95C,104C,113C 'coreaudio':633C,660C 'corrupt':90B,314C,411C,543C,646C,672C 'craft':304C,349C,536C,571C,665C 'crash':86B 'custom':123C 'cve':18A,21A,162C,213C,247C,283C,326C,370C,521C,588C 'cve-id':161C 'data':211C,237C,273C,511C 'dbg.re':530C 'denial':487C 'denial-of-servic':486C 'derefer':494C 'describ':110C 'descript':203C,238C,274C,317C,357C,414C,452C,490C,512C,544C,580C,622C,649C,673C 'disclos':128C,619C 'disclosur':576C 'discuss':129C 'document':109C,157C 'doesn':126C 'duszynski':378C 'elev':63B 'entitl':245C,281C 'exist':4A 'file':306C,350C,667C 'fix':49B,72B 'flaw':52B,79B 'gain':62B 'genericcod':386C 'googl':594C 'handl':7A,325C,632C,659C 'hcamael':331C 'hofman':526C 'huy':286C 'id':163C 'imag':572C 'impact':192C,227C,263C,300C,345C,399C,437C,474C,501C,532C,567C,612C,634C,661C 'improv':14A,210C,323C,367C,425C,462C,498C,555C,586C,630C,657C 'inform':168C 'infrastructur':40B 'initi':625C 'input':463C 'intent':254C 'investig':136C 'invit':538C 'issu':3A,133C,206C,240C,276C,319C,421C,515C,551C,582C,626C,653C 'jb':330C 'jerzi':377C 'jurczyk':592C 'kernel':74B,412C,450C,620C 'later':191C,226C,262C,299C,344C,398C,436C,473C,566C,611C 'lead':308C,352C,540C,669C 'let':59B,83B 'liangwei':250C 'licht':329C 'lili':384C 'list':148C 'log':205C 'lunar815':373C 'mac':25A,29A 'macos':33A,35A 'malici':194C,303C,348C,535C,570C,664C 'mani':73B 'mateusz':591C 'may':196C,230C,266C,307C,351C,402C,440C,480C,504C,539C,573C,615C,637C,668C 'media':75B 'memori':91B,316C,324C,413C,451C,542C,579C,621C,624C,631C,648C,658C,671C 'meta':597C 'mustafa':527C 'nathaniel':387C 'neon':524C 'nguyen':287C 'niel':525C 'nik':601C 'null':492C 'occur':138C 'octob':180C 'oh':388C 'ordinal0':529C 'os':26A,30A 'out-of-bound':359C,416C,454C,546C 'overflow':652C 'page':154C,176C 'patch':140C 'permiss':514C 'physic':478C 'piotr':376C 'pointer':493C 'possibl':165C 'prefer':202C 'privaci':201C 'privileg':64B 'process':301C,315C,346C,533C,568C,578C,647C,662C 'product':174C 'project':595C 'protect':124C 'proxim':479C 'r3pwnx':379C,380C 'read':363C,449C,458C 'recent':145C 'red':598C 'redact':212C 'refer':158C 'releas':70B,142C,146C,153C,179C 'research':383C 'restrict':520C 'result':574C 'secur':94C,103C,112C,119C,132C,152C,156C,170C,175C 'see':171C 'sekhar':375C 'sensit':235C,271C,509C 'seri':188C,223C,259C,296C,341C,395C,433C,470C,563C,608C 'servic':489C 'sever':80B 'sindr':251C 'sorhus':252C 'spotlight':51B 'support':100C 'surej':374C 'symlink':9A,17A,55B 'system':88B,408C,446C,643C 'team':599C 'termin':312C,356C,409C,447C,644C 'tsytsarkin':602C 'unexpect':310C,354C,407C,445C,642C 'updat':120C 'user':236C,272C,510C 'valid':2A,15A,57B,464C,499C 'vendor':42B 'vendor-advisori':41B 'video':305C 'vulner':159C 'watch':39B,67B,187C,222C,258C,295C,340C,394C,432C,469C,562C,607C 'watcho':44B,47B,97C,106C,115C,177C 'webkit':76B 'write':420C,550C 'x':27A,31A,600C 'zero':596C '章鱼哥':333C","nicknames":[],"mitigations":[],"who_affected":"The advisory lists the fixes for Apple Watch Series 9 and later. The Spotlight entry requires a malicious app already installed on the watch, so the exposure is local to the device. Teams that do not manage Apple Watches can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Apple Watch to watchOS 27.2.","first_public_at":"2022-05-26T19:15:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"lab","external_id":"https://support.apple.com/en-us/149525#CVE-2022-26704","url":"https://support.apple.com/en-us/149525","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-29T04:33:06+00:00","fetched_at":"2026-10-29T04:33:06+00:00","note":"Apple: About the security content of watchOS 27.2 - Apple Support"},{"source":"nvd","external_id":"CVE-2022-26704","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26704","severity":null,"published_at":"2022-05-26T19:15:08+00:00","modified_at":"2026-06-17T04:35:39+00:00","first_seen_at":"2026-10-29T04:41:58+00:00","fetched_at":"2026-10-29T04:41:58+00:00","note":null}],"documents":[{"id":14119,"url":"https://support.apple.com/en-us/149525","title":"Apple: About the security content of watchOS 27.2 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of watchOS 27.2 - Apple Support\n\n# About the security content of watchOS 27.2\n\nThis document describes the security content of watchOS 27.2.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## watchOS 27.2\n\nReleased October 26, 2026\n\n### Accounts\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\nDescription: A logging issue was addressed with improved data redaction.\n\nCVE-2026-113898: Bhaswanth Chigurupati\n\n### Accounts\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with additional entitlement checks.\n\nCVE-2026-112446: LiangWei, Sindre Sorhus\n\n### App Intents\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: This issue was addressed with additional entitlement checks.\n\nCVE-2026-112692: Huy Nguyen (@34306) of Calif.io\n\n### AppleAVD\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n\nDescription: The issue was addressed with improved memory handling.\n\nCVE-2026-112454: @Licht_jb, Hcamael and 章鱼哥@aipy (aipyaipy.com)\n\n### Audio\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: Processing a maliciously crafted file may lead to unexpected app termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112546: lunar815, Surej Sekhar, Piotr Jerzy Duszynski, r3pwnx (@r3pwnx), an anonymous researcher, Lily Cohl (@GenericCoding), Nathaniel Oh (@calysteon)\n\n### AVEVideoEncoder\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### AVEVideoEncoder\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\n### Bluetooth\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An attacker in physical proximity may be able to cause a denial-of-service\n\nDescription: A null pointer dereference was addressed with improved validation.\n\n### Calendar\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112678: Neon, Niels Hofmans, Mustafa Calap (@ordinal0, dbg.re)\n\n### Calendar\n\nImpact: Processing a maliciously crafted calendar invitation may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### ColorSync\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: Processing a maliciously crafted image may result in disclosure of process memory\n\nDescription: The issue was addressed with improved checks.\n\nCVE-2026-86988: Mateusz Jurczyk of Google Project Zero, Meta Red Team X - Nik Tsytsarkin\n\n### Compression\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to disclose kernel memory\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\n### CoreAudio\n\nImpact: An app may be able to cause unexpected system termination or corrupt process memory\n\nDescription: A buffer overflow issue was addressed with improved memory handling.\n\n### CoreAudio\n\nImpact: Processing a maliciously crafted audio file may lead to memory corruption\n\nDescription: A buffer overflow was addressed with improved size validation.\n\nCVE-2026-86972: an anonymous researcher, Meta Product Security\n\n### CoreAudio\n\nImpact: An attacker in radio range may be able to cause unexpected system termination\n\nDescription: A heap buffer overflow was addressed with improved bounds checking.\n\nCVE-2026-112638: Përparim Mjeku, Altin Gashi, Altin Gashi\n\n### CoreGraphics\n\nImpact: Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\nCVE-2026-113950: Substrate, Stefan Esser (Calif)\n\n### CoreMedia\n\nImpact: Processing a maliciously crafted video file may lead to unexpected app termination\n\nDescription: The issue was addressed with improved memory handling.\n\n### CoreMedia\n\nDescription: A permissions issue was addressed with additional restrictions.\n\nCVE-2026-112706: Adriatik Raci, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Chris Bailey - Short Circuit\n\n### CoreText\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\n### FontParser\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\n### FontParser\n\n### Heimdal\n\nImpact: An attacker in a privileged network position may be able to impersonate a Kerberos KDC\n\nDescription: An issue with signature validation was addressed with improved checks.\n\nCVE-2026-112518: Roman Zabicki, Tristan Madani (@TristanInSec) from Talence Security\n\n### HomeKit\n\nImpact: Processing a maliciously crafted video file may lead to unexpected system termination\n\nDescription: An integer overflow was addressed with improved bounds checking.\n\n### ImageIO\n\nDescription: A memory initialization issue was addressed with improved memory handling.\n\nCVE-2026-112571: sh3rlock (김보겸)\n\n### ImageIO\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\n### IOHIDFamily\n\nImpact: An attacker may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112515: Charles Stevenson, Seung Je Seong, Mathis Mansière\n\n### IOKit\n\nImpact: A buffer overflow may result in memory corruption and unexpected app termination\n\nDescription: An out-of-bounds write issue was addressed with improved bounds checking.\n\n### IOMobileFrameBuffer\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved state handling.\n\nCVE-2026-112459: Lily Cohl (@GenericCoding), an anonymous researcher\n\n### IOSurface\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A race condition was addressed with improved locking.\n\nCVE-2026-112477: an anonymous researcher\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected changes to copy-on-write memory\n\nDescription: A memory integrity issue was addressed with improved handling of copy-on-write pages.\n\nCVE-2026-112576: Pedro Pinho\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2026-112606: Wang Yu\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-65350: Nebula Security (@nebusecurity), Tim Michaud (@TimGMichaud) of Aginor.ai, Xinru Chi of Pangu Lab\n\nCVE-2026-112679: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use after free issue was addressed with improved memory management.\n\nCVE-2026-112517: Pasquale Scola, Wout van der Ploeg (woutvanderploeg.nl), John Lussier, Cem Onat Karagun, an anonymous researcher\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-112516: greenbynox, an anonymous researcher\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An attacker may be able to cause unexpected system termination or corrupt kernel memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-112514: Marc Newlin of SkySafe, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., greenbynox\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination or write kernel memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-84495: Wang Yu\n\nCVE-2026-112474: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\n### Kernel\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: A race condition was addressed with improved state handling.\n\n### Kernel\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2026-112476: Arnold Cartagena, Matt Suiche (@msuiche) of Tolmo\n\n### Kernel\n\nImpact: An app may be able to determine kernel memory layout\n\nDescription: An information disclosure issue was addressed with improved state management.\n\n### MediaAnalysis\n\nImpact: An app may be able to access sensitive user data\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2026-113915: Abodi Dawoud, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Zhongquan Li (@Guluisacat), Ilya Andr (andrd3v) of Positive Technologies\n\n### Messages\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: A remote attacker may be able to cause unexpected app termination\n\nDescription: An input validation issue was addressed with improved input validation.\n\nCVE-2026-112682: Mahmoud Abdelmoniem\n\n### Shortcuts\n\nAvailable for: Apple Watch Series 9 and later\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-112559: Lucas Lammer, Stuart Wallace\n\nCVE-2026-112455: Chris Bailey - Short Circuit, Rahul Raj\n\n### Siri\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-112685: silo, Abodi Dawoud\n\n### Spotlight\n\nImpact: An app may be able to gain elevated privileges\n\nDescription: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.\n\nCVE-2022-26704: Joshua Mason of Mandiant, Gergely Kalman (@gergely_kalman)\n\n### Spotlight\n\nImpact: A malicious application may be able to bypass Privacy preferences\n\n### SwiftUI\n\nImpact: An app may be able to cause unexpected system termination\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 328114\n\nCVE-2026-113904: Lily Cohl (@GenericCoding), Do Young Park (adawn), MYUNGYONG LEE, Luke Francis (@lukefr09), Shubham Chaskar, Kwak Kiyong, Song Nuri\n\nWebKit Bugzilla: 317465\n\nCVE-2026-112599: Avinash Kumar Thapa & Jay Kaushik Patel\n\n### WebKit\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 322916\n\nCVE-2026-112697: OpenAI Codex Security - Amy Burnett, 은태 장\n\nWebKit Bugzilla: 324150\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process termination\n\nDescription: A race condition was addressed with improved locking.\n\nWebKit Bugzilla: 323986\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process crash\n\nWebKit Bugzilla: 328132\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected Safari crash\n\nDescription: A race condition was addressed with improved state handling.\n\nWebKit Bugzilla: 323173\n\n### WebKit\n\nImpact: Processing maliciously crafted web content may lead to an unexpected process termination\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 321669\n\nCVE-2026-112666: Luke Francis (@lukefr09)\n\nWebKit Bugzilla: 324735\n\n### WebKit\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 324262\n\n### WebKit Canvas\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 323377\n\n### WebKit JavaScript Bindings\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nWebKit Bugzilla: 328141\n\nCVE-2026-112626: Euntae Jang, Luke Francis (@lukefr09), Shubham Chaskar, Josef Korbel (Citadelo)\n\n### CoreAudio\n\nWe would like to acknowledge Meta Product Security for their assistance.\n\n### CoreCrypto\n\nWe would like to acknowledge Niels Hofmans for their assistance.\n\n### Foundation\n\nWe would like to acknowledge Jaya Surya Kommireddy for their assistance.\n\n### Kernel\n\nWe would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Tristan Madani (@TristanInSec) from Talence Security for their assistance.\n\n### libarchive\n\nWe would like to acknowledge Muhammad Abdul Rehman, Owais Lone for their assistance.\n\n### mDNSResponder\n\nWe would like to acknowledge Aswin Kumar Gokula Kannan, Lucas Lammer, pixillated for their assistance.\n\n### Sandbox Profiles\n\nWe would like to acknowledge Ilya Andr (andrd3v) of Positive Technologies for their assistance.\n\n### WebKit\n\nWe would like to acknowledge Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Wael Alolowi for their assistance.\n\n Published Date: October 26, 2026","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":14232,"url":"http://seclists.org/fulldisclosure/2022/Jul/13","title":"Third-party advisory: seclists.org","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: seclists.org"},{"id":14233,"url":"http://seclists.org/fulldisclosure/2022/Jul/14","title":"Third-party advisory: seclists.org","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: seclists.org"},{"id":14234,"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0032/MNDT-2022-0032.md","title":"Third-party advisory: github.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: github.com"},{"id":14235,"url":"https://support.apple.com/en-us/HT213257","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"},{"id":14236,"url":"https://support.apple.com/kb/HT213344","title":"Vendor advisory: support.apple.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: support.apple.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}