{"id":"CVE-2026-112608","kind":"vulnerability","aliases":["CVE-2026-112608"],"related":[],"title":"Apple Bluetooth: crafted packet can leak process memory on Apple devices","description":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted Bluetooth packet may result in disclosure of process memory.","summary":"A malformed Bluetooth packet triggers an out-of-bounds read in Apple's operating systems, which can expose process memory. The fix ships in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","bluetooth","infrastructure","ios","macos","mobile-fleet"],"not_affected_if":["already-on-27-series"],"how_to_check":"- Check the OS version on each Apple device under Settings > General > About (or `sw_vers -productVersion` on macOS) and compare it with the fixed releases.","fix":"- Update iOS and iPadOS to 27 or later.\n- Update macOS to Golden Gate 27 or later.\n- Update tvOS, visionOS and watchOS to 27 or later.","status":"open","published_at":"2026-10-26T21:17:53+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","triaged_at":"2026-10-26T21:27:28+00:00","updated_at":"2026-10-26T21:27:28+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:27:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to 27 or later.\n- Update macOS to Golden Gate 27 or later.\n- Update tvOS, visionOS and watchOS to 27 or later.","reach":"network","title":"Apple Bluetooth: crafted packet can leak process memory on Apple devices","impact":"low","summary":"A malformed Bluetooth packet triggers an out-of-bounds read in Apple's operating systems, which can expose process memory. The fix ships in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.","category":"infrastructure","nicknames":[],"who_cares":["apple","ios","macos","bluetooth","mobile-fleet"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Process memory contents leak to a nearby attacker over Bluetooth","analyst_note":"Check Apple's security notes for CVE-2026-112608 to confirm whether the attack needs pairing or proximity only, and which exact build numbers are fixed.","how_to_check":"- Check the OS version on each Apple device under Settings > General > About (or `sw_vers -productVersion` on macOS) and compare it with the fixed releases.","needs_analyst":true,"not_affected_if":["already-on-27-series"],"who_is_affected":"Any Apple device running a release before the 27 series with Bluetooth enabled is in scope, since the packet is processed by the Bluetooth stack. Sources do not say whether pairing or a nearby attacker is required, so treat Bluetooth-enabled devices as the affected group. Teams that manage only fleets already on the 27 series can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000642,"input_tokens":3302,"output_tokens":624,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112608':14A,17A '-2026':13A,16A '27':52B,54B,58B,60B,62B,65B,84C,87C,91C,93C,95C,97C 'address':73C 'appl':1A,10A,18B,38B 'bluetooth':2A,19B,28B,102C 'bound':35B,70C,76C 'check':77C 'craft':3A,101C 'cve':12A,15A 'devic':11A 'disclosur':107C 'expos':44B 'fix':48B,81C 'fleet':25B 'gate':57B,90C 'golden':56B,89C 'improv':75C 'infrastructur':20B 'io':21B,51B,83C 'ipado':53B,86C 'issu':79C 'leak':6A 'maco':22B,55B,88C 'malform':27B 'malici':100C 'may':104C 'memori':8A,46B,110C 'mobil':24B 'mobile-fleet':23B 'oper':40B 'out-of-bound':32B,67C 'packet':4A,29B,103C 'process':7A,45B,98C,109C 'read':36B,71C 'result':105C 'ship':49B 'system':41B 'trigger':30B 'tvos':59B,92C 'visiono':61B,94C 'watcho':64B,96C","nicknames":[],"mitigations":[],"who_affected":"Any Apple device running a release before the 27 series with Bluetooth enabled is in scope, since the packet is processed by the Bluetooth stack. Sources do not say whether pairing or a nearby attacker is required, so treat Bluetooth-enabled devices as the affected group. Teams that manage only fleets already on the 27 series can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112608","severity":null,"published_at":"2026-10-26T21:17:53+00:00","modified_at":"2026-10-26T21:17:53+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","fetched_at":"2026-10-26T21:20:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}