{"id":"CVE-2026-112547","kind":"vulnerability","aliases":["CVE-2026-112547"],"related":[],"title":"Apple iOS and iPadOS: type confusion lets an app read sensitive user data","description":"A type confusion issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.","summary":"A type confusion flaw in iOS and iPadOS was fixed with improved checks in version 27.2. A malicious app may be able to access sensitive user data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","ios","ipados","mobile-fleet","other"],"not_affected_if":["already-on-27.2"],"how_to_check":"- Check the device version under Settings > General > About; the sources do not give a check command\n- unknown","fix":"- Update iOS and iPadOS to `27.2` or later\n- unknown","status":"open","published_at":"2026-10-26T21:17:47+00:00","first_seen_at":"2026-10-26T21:20:27+00:00","triaged_at":"2026-10-26T21:28:03+00:00","updated_at":"2026-10-26T21:28:03+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-26T21:28:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `27.2` or later\n- unknown","reach":"local","title":"Apple iOS and iPadOS: type confusion lets an app read sensitive user data","impact":"medium","summary":"A type confusion flaw in iOS and iPadOS was fixed with improved checks in version 27.2. A malicious app may be able to access sensitive user data.","category":"other","nicknames":[],"who_cares":["ios","ipados","apple-devices","mobile-fleet"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Malicious app reads sensitive user data on the device","analyst_note":"Check the Apple security release notes for 27.2 to confirm affected versions, the attack requirements, and whether the issue is exploited; the NVD page had no CVSS data.","how_to_check":"- Check the device version under Settings > General > About; the sources do not give a check command\n- unknown","needs_analyst":true,"not_affected_if":["already-on-27.2"],"who_is_affected":"Owners of iPhones and iPads running iOS or iPadOS versions before 27.2. The sources do not say which versions are affected or whether any configuration matters, so the exact scope is unknown. Managed fleets should confirm the update reached each device.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000564,"input_tokens":3246,"output_tokens":478,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112547':16A,19A '-2026':15A,18A '27.2':43B,70C,73C 'abl':49B,78C 'access':51B,80C 'address':60C 'app':9A,46B,75C 'appl':1A,21B 'apple-devic':20B 'check':40B,63C 'confus':6A,30B,57C 'cve':14A,17A 'data':13A,54B,83C 'devic':22B 'fix':37B,67C 'flaw':31B 'fleet':27B 'improv':39B,62C 'io':2A,23B,33B,69C 'ipado':4A,24B,35B,72C 'issu':58C,65C 'let':7A 'malici':45B 'may':47B,76C 'mobil':26B 'mobile-fleet':25B 'read':10A 'sensit':11A,52B,81C 'type':5A,29B,56C 'user':12A,53B,82C 'version':42B","nicknames":[],"mitigations":[],"who_affected":"Owners of iPhones and iPads running iOS or iPadOS versions before 27.2. The sources do not say which versions are affected or whether any configuration matters, so the exact scope is unknown. Managed fleets should confirm the update reached each device.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112547","severity":null,"published_at":"2026-10-26T21:17:47+00:00","modified_at":"2026-10-26T21:17:47+00:00","first_seen_at":"2026-10-26T21:20:27+00:00","fetched_at":"2026-10-26T21:20:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}