{"id":"CVE-2026-112612","kind":"vulnerability","aliases":["CVE-2026-112612"],"related":[],"title":"Apple iOS and iPadOS: path validation flaw lets trusted-paired attacker read and write files","description":"A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files.","summary":"Apple fixed a path handling flaw in iOS and iPadOS that lets an attacker with physical access to a trust-paired device read and write arbitrary files. The sources do not describe the affected component or the exact attack steps.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","ios","ipados","mobile-fleet","vendor"],"not_affected_if":["devices-already-updated","no-physical-access-risk"],"how_to_check":"- Check the iOS or iPadOS version under Settings > General > About; the sources do not name a specific check beyond the version.","fix":"- Update iOS and iPadOS to `26.7.2` or `27.2` or later, per the sources.","status":"open","published_at":"2026-10-26T21:17:53+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","triaged_at":"2026-10-26T21:27:24+00:00","updated_at":"2026-10-26T21:27:24+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-26T21:27:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `26.7.2` or `27.2` or later, per the sources.","reach":"local","title":"Apple iOS and iPadOS: path validation flaw lets trusted-paired attacker read and write files","impact":"medium","summary":"Apple fixed a path handling flaw in iOS and iPadOS that lets an attacker with physical access to a trust-paired device read and write arbitrary files. The sources do not describe the affected component or the exact attack steps.","category":"vendor","nicknames":[],"who_cares":["ios","ipados","apple-devices","mobile-fleet"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker with physical access reads and writes arbitrary device files.","analyst_note":"Check Apple's security notes for iOS 26.7.2 and iOS 27.2 for the affected component and whether the trust-pairing prerequisite is exact.","how_to_check":"- Check the iOS or iPadOS version under Settings > General > About; the sources do not name a specific check beyond the version.","needs_analyst":true,"not_affected_if":["devices-already-updated","no-physical-access-risk"],"who_is_affected":"Owners of iPhones and iPads running iOS or iPadOS versions before 26.7.2 (on the 26.x line) or before 27.2 (on the 27.x line). The sources say the attacker needs physical access to a device that is trust-paired with the target, which limits exposure to people who can reach an unlocked or paired device. Managed fleets should confirm devices have the fixed builds.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000619,"input_tokens":3283,"output_tokens":582,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112612':19A,22A '-2026':18A,21A '26.7.2':88C,91C '27.2':93C,96C 'abl':110C 'access':48B,101C 'address':78C 'affect':66B 'appl':1A,24B,32B 'apple-devic':23B 'arbitrari':58B,115C 'attack':12A,45B,71B,98C 'compon':67B 'cve':17A,20A 'describ':64B 'devic':25B,54B,107C 'exact':70B 'file':16A,59B,116C 'fix':33B,85C 'flaw':7A,37B 'fleet':30B 'handl':36B,75C 'improv':80C 'io':2A,26B,39B,87C,92C 'ipado':4A,27B,41B,90C,95C 'issu':76C,83C 'let':8A,43B 'may':108C 'mobil':29B 'mobile-fleet':28B 'pair':11A,53B,106C 'path':5A,35B,74C 'physic':47B,100C 'read':13A,55B,112C 'sourc':61B 'step':72B 'trust':10A,52B,105C 'trust-pair':51B,104C 'trusted-pair':9A 'valid':6A,81C 'vendor':31B 'write':15A,57B,114C","nicknames":[],"mitigations":[],"who_affected":"Owners of iPhones and iPads running iOS or iPadOS versions before 26.7.2 (on the 26.x line) or before 27.2 (on the 27.x line). The sources say the attacker needs physical access to a device that is trust-paired with the target, which limits exposure to people who can reach an unlocked or paired device. Managed fleets should confirm devices have the fixed builds.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112612","severity":null,"published_at":"2026-10-26T21:17:53+00:00","modified_at":"2026-10-26T21:17:53+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","fetched_at":"2026-10-26T21:20:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}