--- id: "CVE-2022-26704" kind: "vulnerability" aliases: ["CVE-2022-26704"] title: "A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks" severity: "high" cvss: 7.8 epss: null exploited: false status: "open" category: "infrastructure" products: [{"name": "apple mac os x", "fixed": ["10.15.7"], "affected": ">= 10.15, < 10.15.7", "ecosystem": "vendor"}, {"name": "apple mac os x", "fixed": [], "affected": "= 10.15.7", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["11.6.8"], "affected": ">= 11.0, < 11.6.8", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["12.4"], "affected": ">= 12.0.0, < 12.4", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "apple-watch", "infrastructure", "vendor-advisory", "watchos"] not_affected_if: [] published_at: "2022-05-26T19:15:08+00:00" first_seen_at: "2026-10-29T04:33:06+00:00" updated_at: "2026-10-29T04:41:58+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/149525", "first_seen_at": "2026-10-29T04:33:06+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26704", "first_seen_at": "2026-10-29T04:41:58+00:00"}] --- # A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks Apple's watchOS 27.2 fixes a Spotlight flaw in how symlinks were validated, which let an app gain elevated privileges on the watch. The same release also fixes many kernel, media, WebKit and other flaws, several of which let an app crash the system or corrupt memory. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:apple mac os x affected >= 10.15, < 10.15.7 fixed 10.15.7 - vendor:apple mac os x affected = 10.15.7 fixed ? - vendor:apple macos affected >= 11.0, < 11.6.8 fixed 11.6.8 - vendor:apple macos affected >= 12.0.0, < 12.4 fixed 12.4 ## Fix - watchOS `27.2` ## Timeline - 2026-10-29T04:33:06+00:00 lab https://support.apple.com/en-us/149525 — Apple: About the security content of watchOS 27.2 - Apple Support - 2026-10-29T04:41:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-26704 ## Documents - [advisory] Apple: About the security content of watchOS 27.2 - Apple Support https://support.apple.com/en-us/149525 - [advisory] Third-party advisory: seclists.org http://seclists.org/fulldisclosure/2022/Jul/13 - [advisory] Third-party advisory: seclists.org http://seclists.org/fulldisclosure/2022/Jul/14 - [advisory] Third-party advisory: github.com https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0032/MNDT-2022-0032.md - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/HT213257 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/kb/HT213344 ## From the sources About the security content of watchOS 27.2 - Apple Support # About the security content of watchOS 27.2 This document describes the security content of watchOS 27.2. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## watchOS 27.2 Released October 26, 2026 ### Accounts Available for: Apple Watch Series 9 and later Impact: A malicious application may be able to bypass Privacy preferences Description: A logging issue was addressed with improved data redaction. CVE-2026-113898: Bhaswanth Chigurupati ### Accounts Available for: Apple Watch Series 9 and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with additional entitlement checks. CVE-2026-112446: LiangWei, Sindre Sorhus ### App Intents Available for: Apple Watch Series 9 and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with additional entitlement checks. CVE-2026-112692: Huy Nguyen (@34306) of Calif.io ### AppleAVD Available for: Apple Watch Series 9 and later Impact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-112454: @Licht_jb, Hcamael and 章鱼哥@aipy (aipyaipy.com) ### Audio Available for: Apple Watch Series 9 and later Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112546: lunar815, Surej Sekhar, Piotr Jerzy Duszynski, r3pwnx (@r3pwnx), an anonymous researcher, Lily Cohl (@GenericCoding), Nathaniel Oh (@calysteon) ### AVEVideoEncoder Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. ### AVEVideoEncoder Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. ### Bluetooth Available for: Apple Watch Series 9 and later Impact: An attacker in physical proximity may be able to cause a denial-of-service Description: A null pointer dereference was addressed with improved validation. ### Calendar Impact: An app may be able to access sensitive user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-112678: Neon, Niels Hofmans, Mustafa Calap (@ordinal0, dbg.re) ### Calendar Impact: Processing a maliciously crafted calendar invitation may lead to memory corruption Description: An out-of-bounds write issue was addressed with improved bounds checking. ### ColorSync Available for: Apple Watch Series 9 and later Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: The issue was addressed with improved checks. CVE-2026-86988: Mateusz Jurczyk of Google Project Zero, Meta Red Team X - Nik Tsytsarkin ### Compression Available for: Apple Watch Series 9 and later Impact: An app may be able to disclose kernel memory Description: A memory initialization issue was addressed with improved memory handling. ### CoreAudio Impact: An app may be able to cause unexpected system termination or corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. ### CoreAudio Impact: Processing a maliciously crafted audio file may lead to memory corruption Description: A buffer overflow was addressed with improved size validation. CVE-2026-86972: an anonymous researcher, Meta Product Security ### CoreAudio Impact: An attacker in radio range may be able to cause unexpected system termination Description: A heap buffer overflow was addressed with improved bounds checking. CVE-2026-112638: Përparim Mjeku, Altin Gashi, Altin Gashi ### CoreGraphics Impact: Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-113950: Substrate, Stefan Esser (Calif) ### CoreMedia Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: The issue was addressed with improved memory handling. ### CoreMedia Description: A permissions issue was addressed with additional restrictions. CVE-2026-112706: Adriatik Raci, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Chris Bailey - Short Circuit ### CoreText Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. ### FontParser Description: An out-of-bounds read was addressed with improved input validation. ### FontParser ### Heimdal Impact: An attacker in a privileged network position may be able to impersonate a Kerberos KDC Description: An issue with signature validation was addressed with improved checks. CVE-2026-112518: Roman Zabicki, Tristan Madani (@TristanInSec) from Talence Security ### HomeKit Impact: Processing a maliciously crafted video file may lead to unexpected system termination Description: An integer overflow was addressed with improved bounds checking. ### ImageIO Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-112571: sh3rlock (김보겸) ### ImageIO Description: An out-of-bounds read was addressed with improved bounds checking. ### IOHIDFamily Impact: An attacker may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112515: Charles Stevenson, Seung Je Seong, Mathis Mansière ### IOKit Impact: A buffer overflow may result in memory corruption and unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. ### IOMobileFrameBuffer Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A race condition was addressed with improved state handling. CVE-2026-112459: Lily Cohl (@GenericCoding), an anonymous researcher ### IOSurface Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A race condition was addressed with improved locking. CVE-2026-112477: an anonymous researcher ### Kernel Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected changes to copy-on-write memory Description: A memory integrity issue was addressed with improved handling of copy-on-write pages. CVE-2026-112576: Pedro Pinho ### Kernel Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination Description: A type confusion issue was addressed with improved memory handling. CVE-2026-112606: Wang Yu ### Kernel Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-65350: Nebula Security (@nebusecurity), Tim Michaud (@TimGMichaud) of Aginor.ai, Xinru Chi of Pangu Lab CVE-2026-112679: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. ### Kernel Available for: Apple Watch Series 9 and la --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_