{"id":"CVE-2026-112607","kind":"vulnerability","aliases":["CVE-2026-112607"],"related":[],"title":"Apple iOS, iPadOS and macOS: out-of-bounds read can leak memory remotely","description":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2. A remote attacker may be able to leak memory.","summary":"An out-of-bounds read in Apple's operating systems lets a remote attacker leak memory contents. Apple fixed it with improved bounds checking in iOS 27.2, iPadOS 27.2 and macOS Golden Gate 27.2.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","end-user-devices","infrastructure","ios","ipados","macos"],"not_affected_if":["already-updated-to-27.2"],"how_to_check":"- Check the device version under Settings > General > About (iOS and iPadOS) or `sw_vers -productVersion` on macOS\n- unknown for the specific affected component","fix":"- Update iOS and iPadOS to `27.2` or later\n- Update macOS Golden Gate to `27.2` or later","status":"open","published_at":"2026-10-26T21:17:53+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","triaged_at":"2026-10-26T21:27:28+00:00","updated_at":"2026-10-26T21:27:28+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:27:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `27.2` or later\n- Update macOS Golden Gate to `27.2` or later","reach":"internet","title":"Apple iOS, iPadOS and macOS: out-of-bounds read can leak memory remotely","impact":"low","summary":"An out-of-bounds read in Apple's operating systems lets a remote attacker leak memory contents. Apple fixed it with improved bounds checking in iOS 27.2, iPadOS 27.2 and macOS Golden Gate 27.2.","category":"infrastructure","nicknames":[],"who_cares":["apple","ios","ipados","macos","end-user-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker leaks memory contents from the affected device","analyst_note":"Check Apple's security notes for the affected component and whether user interaction is needed; the NVD entry gives no details.","how_to_check":"- Check the device version under Settings > General > About (iOS and iPadOS) or `sw_vers -productVersion` on macOS\n- unknown for the specific affected component","needs_analyst":true,"not_affected_if":["already-updated-to-27.2"],"who_is_affected":"Devices running iOS 27.2 or iPadOS 27.2 earlier versions and macOS Golden Gate before 27.2 are affected. The sources do not say which component or configuration is reachable, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000597,"input_tokens":3271,"output_tokens":540,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112607':17A,20A '-2026':16A,19A '27.2':57B,59B,64B,83C,86C,90C 'abl':96C 'address':72C 'appl':1A,21B,37B,48B 'attack':44B,93C 'bound':9A,34B,53B,69C,75C 'check':54B,76C 'content':47B 'cve':15A,18A 'devic':25B 'end':23B 'end-user-devic':22B 'fix':49B,80C 'gate':63B,89C 'golden':62B,88C 'improv':52B,74C 'infrastructur':26B 'io':2A,27B,56B,82C 'ipado':3A,28B,58B,85C 'issu':78C 'leak':12A,45B,98C 'let':41B 'maco':5A,29B,61B,87C 'may':94C 'memori':13A,46B,99C 'oper':39B 'out-of-bound':6A,31B,66C 'read':10A,35B,70C 'remot':14A,43B,92C 'system':40B 'user':24B","nicknames":[],"mitigations":[],"who_affected":"Devices running iOS 27.2 or iPadOS 27.2 earlier versions and macOS Golden Gate before 27.2 are affected. The sources do not say which component or configuration is reachable, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112607","severity":null,"published_at":"2026-10-26T21:17:53+00:00","modified_at":"2026-10-26T21:17:53+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","fetched_at":"2026-10-26T21:20:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}