{"id":"CVE-2026-112620","kind":"vulnerability","aliases":["CVE-2026-112620"],"related":[],"title":"Apple OS: input validation flaw lets a network attacker cause denial of service","description":"A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2. An attacker in a privileged network position may be able to cause a denial-of-service.","summary":"Apple fixed a denial-of-service flaw in iOS, iPadOS, macOS, tvOS and visionOS 27.2 through better input validation. The description says an attacker in a privileged network position may be able to crash or stall affected devices.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","ios","ipados","macos","tvos","visionos"],"not_affected_if":["already-on-27.2"],"how_to_check":"- Check the installed OS version under Settings > General > About (iOS/iPadOS/visionOS/tvOS) or Apple menu > About This Mac (macOS).\n- Compare against the fixed release `27.2` for each product listed.","fix":"- Update iOS and iPadOS to `27.2` or later.\n- Update macOS Golden Gate to `27.2` or later.\n- Update tvOS and visionOS to `27.2` or later.","status":"open","published_at":"2026-10-26T21:17:55+00:00","first_seen_at":"2026-10-26T21:20:29+00:00","triaged_at":"2026-10-26T21:25:19+00:00","updated_at":"2026-10-26T21:25:19+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:25:19Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `27.2` or later.\n- Update macOS Golden Gate to `27.2` or later.\n- Update tvOS and visionOS to `27.2` or later.","reach":"network","title":"Apple OS: input validation flaw lets a network attacker cause denial of service","impact":"low","summary":"Apple fixed a denial-of-service flaw in iOS, iPadOS, macOS, tvOS and visionOS 27.2 through better input validation. The description says an attacker in a privileged network position may be able to crash or stall affected devices.","category":"infrastructure","nicknames":[],"who_cares":["ios","ipados","macos","tvos","visionos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker causes denial of service on the device","analyst_note":"Check Apple's security release notes for CVE-2026-112620 to learn which component and which network input triggers the denial of service.","how_to_check":"- Check the installed OS version under Settings > General > About (iOS/iPadOS/visionOS/tvOS) or Apple menu > About This Mac (macOS).\n- Compare against the fixed release `27.2` for each product listed.","needs_analyst":true,"not_affected_if":["already-on-27.2"],"who_is_affected":"Owners of Apple devices running the listed OS versions before 27.2. The description does not name a specific feature or configuration that triggers it, so the sources do not say which networks or services are most exposed. Teams with no Apple devices in scope can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000618,"input_tokens":3295,"output_tokens":577,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112620':16A,19A '-2026':15A,18A '27.2':44B,86C,89C,93C,95C,97C 'abl':61B,107C 'address':75C 'affect':66B 'appl':1A,21B,29B 'apple-devic':20B 'attack':9A,53B,99C 'better':46B 'caus':10A,109C 'crash':63B 'cve':14A,17A 'denial':11A,33B,70C,112C 'denial-of-servic':32B,69C,111C 'descript':50B 'devic':22B,67B 'fix':30B,83C 'flaw':5A,36B 'gate':92C 'golden':91C 'improv':77C 'infrastructur':23B 'input':3A,47B,78C 'io':24B,38B,85C 'ipado':25B,39B,88C 'issu':73C,81C 'let':6A 'maco':26B,40B,90C 'may':59B,105C 'network':8A,57B,103C 'os':2A 'posit':58B,104C 'privileg':56B,102C 'say':51B 'servic':13A,35B,72C,114C 'stall':65B 'tvos':27B,41B,94C 'valid':4A,48B,79C 'visiono':28B,43B,96C","nicknames":[],"mitigations":[],"who_affected":"Owners of Apple devices running the listed OS versions before 27.2. The description does not name a specific feature or configuration that triggers it, so the sources do not say which networks or services are most exposed. Teams with no Apple devices in scope can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112620","severity":null,"published_at":"2026-10-26T21:17:55+00:00","modified_at":"2026-10-26T21:17:55+00:00","first_seen_at":"2026-10-26T21:20:29+00:00","fetched_at":"2026-10-26T21:20:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}