{"id":"CVE-2026-112646","kind":"vulnerability","aliases":["CVE-2026-112646"],"related":[],"title":"Apple iOS and visionOS: out-of-bounds write lets an app corrupt memory","description":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt process memory.","summary":"An out-of-bounds write in Apple's operating systems lets an app crash the system or corrupt process memory. Apple fixed it in iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, iPadOS 27.2 and visionOS 27.2.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","ios","ipados","mobile-fleet","visionos"],"not_affected_if":["already-patched"],"how_to_check":"- Check the device version under Settings > General > About, or run `sw_vers` on a Mac-based test host.\n- Compare against the fixed builds: iOS and iPadOS `26.7.2` or `27.2`, visionOS `27.2`.","fix":"- Update iOS and iPadOS to `26.7.2` or `27.2`, and visionOS to `27.2`.","status":"open","published_at":"2026-10-26T21:17:58+00:00","first_seen_at":"2026-10-26T21:20:29+00:00","triaged_at":"2026-10-26T21:23:59+00:00","updated_at":"2026-10-26T21:23:59+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:23:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `26.7.2` or `27.2`, and visionOS to `27.2`.","reach":"local","title":"Apple iOS and visionOS: out-of-bounds write lets an app corrupt memory","impact":"medium","summary":"An out-of-bounds write in Apple's operating systems lets an app crash the system or corrupt process memory. Apple fixed it in iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, iPadOS 27.2 and visionOS 27.2.","category":"infrastructure","nicknames":[],"who_cares":["ios","ipados","visionos","mobile-fleet"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A local app corrupts process memory or crashes the system.","analyst_note":"Check Apple's security notes for iOS 26.7.2 and iOS 27.2 for the affected components and whether any exploitation is known; the NVD entry has no scores.","how_to_check":"- Check the device version under Settings > General > About, or run `sw_vers` on a Mac-based test host.\n- Compare against the fixed builds: iOS and iPadOS `26.7.2` or `27.2`, visionOS `27.2`.","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"Devices running iOS, iPadOS or visionOS builds older than the fixed versions are affected, since the flaw is in the system itself and any installed app may trigger it. The sources do not say which hardware or configurations are most exposed. Teams that only manage up-to-date fleets can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00063,"input_tokens":3302,"output_tokens":600,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112646':17A,20A '-2026':16A,19A '26.7.2':54B,56B,83C,86C '27.2':58B,60B,63B,88C,91C,93C 'abl':98C 'address':72C 'app':12A,41B,95C 'appl':1A,35B,49B 'bound':8A,32B,68C,75C 'caus':100C 'check':76C 'corrupt':13A,46B,105C 'crash':42B 'cve':15A,18A 'fix':50B,80C 'fleet':26B 'improv':74C 'infrastructur':21B 'io':2A,22B,53B,57B,82C,87C 'ipado':23B,55B,59B,85C,90C 'issu':70C,78C 'let':10A,39B 'may':96C 'memori':14A,48B,107C 'mobil':25B 'mobile-fleet':24B 'oper':37B 'out-of-bound':5A,29B,65C 'process':47B,106C 'system':38B,44B,102C 'termin':103C 'unexpect':101C 'visiono':4A,27B,62B,92C 'write':9A,33B,69C","nicknames":[],"mitigations":[],"who_affected":"Devices running iOS, iPadOS or visionOS builds older than the fixed versions are affected, since the flaw is in the system itself and any installed app may trigger it. The sources do not say which hardware or configurations are most exposed. Teams that only manage up-to-date fleets can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112646","severity":null,"published_at":"2026-10-26T21:17:58+00:00","modified_at":"2026-10-26T21:17:58+00:00","first_seen_at":"2026-10-26T21:20:29+00:00","fetched_at":"2026-10-26T21:20:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}