{"id":"CVE-2026-112658","kind":"vulnerability","aliases":["CVE-2026-112658"],"related":[],"title":"Apple iOS and macOS: input validation flaw exposes sensitive user data","description":"This issue was addressed with improved input validation. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2. An app may be able to access sensitive user data.","summary":"An app installed on an Apple device can read sensitive user data because of an input validation flaw, per Apple's advisory text. Apple fixed it in iOS 27.2, iPadOS 27.2 and macOS Golden Gate 27.2.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","ios","ipados","macos"],"not_affected_if":["already-updated-to-27.2"],"how_to_check":"- Check the device version under Settings > General > About (iOS and iPadOS) or Apple menu > About This Mac (macOS)\n- Compare against `27.2` for iOS, iPadOS and macOS Golden Gate","fix":"- Update iOS and iPadOS to `27.2` or later\n- Update macOS Golden Gate to `27.2` or later","status":"open","published_at":"2026-10-26T21:17:59+00:00","first_seen_at":"2026-10-26T21:20:29+00:00","triaged_at":"2026-10-26T21:23:52+00:00","updated_at":"2026-10-26T21:23:52+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-26T21:23:52Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `27.2` or later\n- Update macOS Golden Gate to `27.2` or later","reach":"local","title":"Apple iOS and macOS: input validation flaw exposes sensitive user data","impact":"medium","summary":"An app installed on an Apple device can read sensitive user data because of an input validation flaw, per Apple's advisory text. Apple fixed it in iOS 27.2, iPadOS 27.2 and macOS Golden Gate 27.2.","category":"infrastructure","nicknames":[],"who_cares":["ios","ipados","macos","apple-devices"],"confidence":0.4,"needs_auth":"unknown","worst_case":"A malicious app reads sensitive user data on the device","analyst_note":"Check Apple's security notes for iOS 27.2 and macOS Golden Gate 27.2 to learn which data is exposed and whether a malicious app needs any special permission.","how_to_check":"- Check the device version under Settings > General > About (iOS and iPadOS) or Apple menu > About This Mac (macOS)\n- Compare against `27.2` for iOS, iPadOS and macOS Golden Gate","needs_analyst":true,"not_affected_if":["already-updated-to-27.2"],"who_is_affected":"Anyone running iOS or iPadOS before 27.2, or macOS Golden Gate before 27.2, on a device where a third-party app could be installed. The sources do not say which data types or configurations are reachable, so the exact exposure is unknown. Managed devices should confirm the update reaches them.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000617,"input_tokens":3254,"output_tokens":583,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112658':14A,17A '-2026':13A,16A '27.2':53B,55B,60B,75C,78C,82C 'abl':87C 'access':89C 'address':64C 'advisori':46B 'app':26B,84C 'appl':1A,19B,30B,44B,48B 'apple-devic':18B 'cve':12A,15A 'data':11A,36B,92C 'devic':20B,31B 'expos':8A 'fix':49B,72C 'flaw':7A,42B 'gate':59B,81C 'golden':58B,80C 'improv':66C 'infrastructur':21B 'input':5A,40B,67C 'instal':27B 'io':2A,22B,52B,74C 'ipado':23B,54B,77C 'issu':62C,70C 'maco':4A,24B,57B,79C 'may':85C 'per':43B 'read':33B 'sensit':9A,34B,90C 'text':47B 'user':10A,35B,91C 'valid':6A,41B,68C","nicknames":[],"mitigations":[],"who_affected":"Anyone running iOS or iPadOS before 27.2, or macOS Golden Gate before 27.2, on a device where a third-party app could be installed. The sources do not say which data types or configurations are reachable, so the exact exposure is unknown. Managed devices should confirm the update reaches them.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112658","severity":null,"published_at":"2026-10-26T21:17:59+00:00","modified_at":"2026-10-26T21:17:59+00:00","first_seen_at":"2026-10-26T21:20:29+00:00","fetched_at":"2026-10-26T21:20:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}