{"id":"CVE-2026-112606","kind":"vulnerability","aliases":["CVE-2026-112606"],"related":[],"title":"Apple iOS and macOS: type confusion lets an app crash the system","description":"A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination.","summary":"A type confusion bug in Apple's operating systems was fixed with better memory handling. A malicious app can trigger it to force an unexpected system termination, which is a denial-of-service effect.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","infrastructure","ios","ipados","macos","tvos","visionos","watchos"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Check the device OS version in Settings > General > About (iOS, iPadOS, visionOS, watchOS, tvOS) or Apple menu > About This Mac (macOS)\n- Compare against the fixed builds listed in the advisory: iOS 26.7.2, iPadOS 26.7.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, iOS/iPadOS/tvOS/visionOS/watchOS 27.2","fix":"- Update iOS and iPadOS to `26.7.2` or `27.2`\n- Update macOS Tahoe to `26.7.2`, macOS Sequoia to `15.8.2`, or macOS Golden Gate to `27.2`\n- Update tvOS, visionOS and watchOS to `27.2`","status":"open","published_at":"2026-10-26T21:17:52+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","triaged_at":"2026-10-26T21:27:32+00:00","updated_at":"2026-10-26T21:27:32+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T21:27:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `26.7.2` or `27.2`\n- Update macOS Tahoe to `26.7.2`, macOS Sequoia to `15.8.2`, or macOS Golden Gate to `27.2`\n- Update tvOS, visionOS and watchOS to `27.2`","reach":"local","title":"Apple iOS and macOS: type confusion lets an app crash the system","impact":"low","summary":"A type confusion bug in Apple's operating systems was fixed with better memory handling. A malicious app can trigger it to force an unexpected system termination, which is a denial-of-service effect.","category":"infrastructure","nicknames":[],"who_cares":["apple","ios","ipados","macos","tvos","visionos","watchos"],"confidence":0.6,"needs_auth":"no","worst_case":"A malicious app forces the system to terminate unexpectedly","analyst_note":"","how_to_check":"- Check the device OS version in Settings > General > About (iOS, iPadOS, visionOS, watchOS, tvOS) or Apple menu > About This Mac (macOS)\n- Compare against the fixed builds listed in the advisory: iOS 26.7.2, iPadOS 26.7.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, iOS/iPadOS/tvOS/visionOS/watchOS 27.2","needs_analyst":false,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Any device running the affected Apple operating system versions is in scope, since the flaw sits in system code rather than a third-party package. The sources describe the impact as an app causing system termination, and do not say whether this needs a specific configuration. Teams running only managed, fully patched fleets on the fixed versions can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000666,"input_tokens":3346,"output_tokens":663,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112606':15A,18A '-2026':14A,17A '15.8.2':93C '26.7.2':78C,81C,96C '27.2':83C,86C,90C,98C,100C,102C 'abl':107C 'address':67C 'app':9A,44B,104C 'appl':1A,19B,32B 'better':39B 'bug':30B 'caus':109C 'confus':6A,29B,64C 'crash':10A 'cve':13A,16A 'denial':58B 'denial-of-servic':57B 'effect':61B 'fix':37B,75C 'forc':49B 'gate':89C 'golden':88C 'handl':41B,71C 'improv':69C 'infrastructur':20B 'io':2A,21B,77C,82C 'ipado':22B,80C,85C 'issu':65C,73C 'let':7A 'maco':4A,23B,87C,91C,94C 'malici':43B 'may':105C 'memori':40B,70C 'oper':34B 'sequoia':92C 'servic':60B 'system':12A,35B,52B,111C 'taho':95C 'termin':53B,112C 'trigger':46B 'tvos':24B,97C 'type':5A,28B,63C 'unexpect':51B,110C 'visiono':25B,99C 'watcho':26B,101C","nicknames":[],"mitigations":[],"who_affected":"Any device running the affected Apple operating system versions is in scope, since the flaw sits in system code rather than a third-party package. The sources describe the impact as an app causing system termination, and do not say whether this needs a specific configuration. Teams running only managed, fully patched fleets on the fixed versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:52+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112606","severity":null,"published_at":"2026-10-26T21:17:52+00:00","modified_at":"2026-10-26T21:17:52+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","fetched_at":"2026-10-26T21:20:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}