{"id":"CVE-2026-112454","kind":"vulnerability","aliases":["CVE-2026-112454"],"related":[],"title":"Apple media stack: crafted video file can crash apps or corrupt memory","description":"The issue was addressed with improved memory handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.","summary":"Processing a maliciously crafted video file can cause unexpected app termination or corrupt process memory in Apple's operating systems. The sources do not state whether this leads to code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","ios","ipados","macos","other","tvos","visionos","watchos"],"not_affected_if":["already-on-27.2"],"how_to_check":"- Check the installed OS version on Apple devices (Settings > General > About, or `sw_vers` on macOS) against the fixed release listed below.","fix":"- Update iOS and iPadOS to `27.2`, macOS Golden Gate to `27.2`, tvOS, visionOS and watchOS to `27.2`.","status":"open","published_at":"2026-10-26T21:17:35+00:00","first_seen_at":"2026-10-26T21:20:25+00:00","triaged_at":"2026-10-26T21:30:25+00:00","updated_at":"2026-10-26T21:30:25+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-26T21:30:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `27.2`, macOS Golden Gate to `27.2`, tvOS, visionOS and watchOS to `27.2`.","reach":"unknown","title":"Apple media stack: crafted video file can crash apps or corrupt memory","impact":"medium","summary":"Processing a maliciously crafted video file can cause unexpected app termination or corrupt process memory in Apple's operating systems. The sources do not state whether this leads to code execution.","category":"other","nicknames":[],"who_cares":["apple","ios","macos","ipados","tvos","visionos","watchos"],"confidence":0.5,"needs_auth":"unknown","worst_case":"App crashes or process memory corrupted via crafted video file","analyst_note":"Sources give only Apple's generic description; check Apple's security release notes for the affected component and whether memory corruption enables code execution.","how_to_check":"- Check the installed OS version on Apple devices (Settings > General > About, or `sw_vers` on macOS) against the fixed release listed below.","needs_analyst":true,"not_affected_if":["already-on-27.2"],"who_is_affected":"Anyone running the listed Apple OS versions earlier than 27.2 who opens untrusted video files or media. The sources do not describe any server-side or developer-specific exposure.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000578,"input_tokens":3302,"output_tokens":496,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112454':15A,18A '-2026':14A,17A '27.2':72C,75C,79C,81C,83C,85C 'address':61C 'app':9A,36B,96C 'appl':1A,19B,43B 'caus':34B 'code':56B 'corrupt':11A,39B,99C 'craft':4A,30B,89C 'crash':8A 'cve':13A,16A 'execut':57B 'file':6A,32B,91C 'fix':69C 'gate':78C 'golden':77C 'handl':65C 'improv':63C 'io':20B,71C 'ipado':21B,74C 'issu':59C,67C 'lead':54B,93C 'maco':22B,76C 'malici':29B,88C 'may':92C 'media':2A 'memori':12A,41B,64C,101C 'oper':45B 'process':27B,40B,86C,100C 'sourc':48B 'stack':3A 'state':51B 'system':46B 'termin':37B,97C 'tvos':24B,80C 'unexpect':35B,95C 'video':5A,31B,90C 'visiono':25B,82C 'watcho':26B,84C 'whether':52B","nicknames":[],"mitigations":[],"who_affected":"Anyone running the listed Apple OS versions earlier than 27.2 who opens untrusted video files or media. The sources do not describe any server-side or developer-specific exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112454","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112454","severity":null,"published_at":"2026-10-26T21:17:35+00:00","modified_at":"2026-10-26T21:17:35+00:00","first_seen_at":"2026-10-26T21:20:25+00:00","fetched_at":"2026-10-26T21:20:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}