---
id: "CVE-2026-112560"
kind: "vulnerability"
aliases: ["CVE-2026-112560"]
title: "Apple image processing bug leaks process memory via crafted image"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["apple", "ios", "ipados", "macos", "tvos", "vendor", "visionos", "watchos"]
not_affected_if: ["fixed-version"]
published_at: "2026-10-26T21:17:49+00:00"
first_seen_at: "2026-10-26T21:20:28+00:00"
updated_at: "2026-10-26T21:27:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112560", "first_seen_at": "2026-10-26T21:20:28+00:00"}]
---

# Apple image processing bug leaks process memory via crafted image

An out-of-bounds read in Apple's image processing lets a maliciously crafted image disclose process memory. Apple fixed it with improved bounds checking in several OS releases.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the device or Mac OS version under Settings > General > About (iOS/iPadOS/visionOS/watchOS/tvOS) or Apple menu > About This Mac (macOS).

## Fix

- Update iOS and iPadOS to `26.7.2`.
- Update macOS Tahoe to `26.7.2` and macOS Sequoia to `15.8.2`.
- Update tvOS, visionOS and watchOS to `27.2`.

## Timeline

- 2026-10-26T21:20:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112560

## From the sources

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_