Live › vulnerability › CVE-2026-112612
Go to dashboardApple fixed a path handling flaw in iOS and iPadOS that lets an attacker with physical access to a trust-paired device read and write arbitrary files. The sources do not describe the affected component or the exact attack steps.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Owners of iPhones and iPads running iOS or iPadOS versions before 26.7.2 (on the 26.x line) or before 27.2 (on the 27.x line). The sources say the attacker needs physical access to a device that is trust-paired with the target, which limits exposure to people who can reach an unlocked or paired device. Managed fleets should confirm devices have the fixed builds.
No product ranges from the sources yet.
26.7.2 or 27.2 or later, per the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files.
This page as .md · .json · in your agent: get_signal("CVE-2026-112612")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.