{"id":"CVE-2026-112596","kind":"vulnerability","aliases":["CVE-2026-112596"],"related":[],"title":"Apple OS: crafted video file can crash the system","description":"An integer overflow was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected system termination.","summary":"An integer overflow in video file processing on Apple platforms can be triggered by a maliciously crafted video file. The sources say the result is unexpected system termination, not code execution.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","infrastructure","ios","ipados","macos","tvos","visionos","watchos"],"not_affected_if":["already-on-27.2"],"how_to_check":"- Check the OS version on each Apple device: iOS or iPadOS, macOS, tvOS, visionOS, watchOS, compared against 27.2 (unknown whether the sources list exact build strings)","fix":"- Update iOS and iPadOS, macOS, tvOS, visionOS and watchOS to `27.2` or later","status":"open","published_at":"2026-10-26T21:17:52+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","triaged_at":"2026-10-26T21:27:34+00:00","updated_at":"2026-10-26T21:27:34+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T21:27:34Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS, macOS, tvOS, visionOS and watchOS to `27.2` or later","reach":"unknown","title":"Apple OS: crafted video file can crash the system","impact":"low","summary":"An integer overflow in video file processing on Apple platforms can be triggered by a maliciously crafted video file. The sources say the result is unexpected system termination, not code execution.","category":"infrastructure","nicknames":[],"who_cares":["apple","ios","ipados","macos","tvos","visionos","watchos"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Unexpected system crash or restart when a crafted video is processed","analyst_note":"","how_to_check":"- Check the OS version on each Apple device: iOS or iPadOS, macOS, tvOS, visionOS, watchOS, compared against 27.2 (unknown whether the sources list exact build strings)","needs_analyst":false,"not_affected_if":["already-on-27.2"],"who_is_affected":"Apple devices running iOS 27.2 or earlier, iPadOS, macOS Golden Gate, tvOS, visionOS or watchOS before 27.2 that process video files. The sources do not describe which apps or data paths reach the flaw, so unknown whether a remote sender can trigger it without any user action.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000579,"input_tokens":3302,"output_tokens":497,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112596':12A,15A '-2026':11A,14A '27.2':70C,73C,77C,79C,81C,83C 'address':59C 'appl':1A,16B,32B 'bound':62C 'check':63C 'code':53B 'craft':3A,40B,87C 'crash':7A 'cve':10A,13A 'execut':54B 'file':5A,29B,42B,89C 'fix':67C 'gate':76C 'golden':75C 'improv':61C 'infrastructur':17B 'integ':25B,56C 'io':18B,69C 'ipado':19B,72C 'issu':65C 'lead':91C 'maco':20B,74C 'malici':39B,86C 'may':90C 'os':2A 'overflow':26B,57C 'platform':33B 'process':30B,84C 'result':47B 'say':45B 'sourc':44B 'system':9A,50B,94C 'termin':51B,95C 'trigger':36B 'tvos':21B,78C 'unexpect':49B,93C 'video':4A,28B,41B,88C 'visiono':22B,80C 'watcho':23B,82C","nicknames":[],"mitigations":[],"who_affected":"Apple devices running iOS 27.2 or earlier, iPadOS, macOS Golden Gate, tvOS, visionOS or watchOS before 27.2 that process video files. The sources do not describe which apps or data paths reach the flaw, so unknown whether a remote sender can trigger it without any user action.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:52+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112596","severity":null,"published_at":"2026-10-26T21:17:52+00:00","modified_at":"2026-10-26T21:17:52+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","fetched_at":"2026-10-26T21:20:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}