{"id":"CVE-2026-112688","kind":"vulnerability","aliases":["CVE-2026-112688"],"related":[],"title":"Apple iOS and macOS: memory corruption when parsing a file","description":"A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Parsing a file may lead to an unexpected app termination or arbitrary code execution.","summary":"A memory corruption flaw in Apple's platforms can be triggered when a file is parsed, causing the app to crash or potentially run arbitrary code. The description does not name the affected component.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","ios","ipados","macos","vendor"],"not_affected_if":["fixed-os-version"],"how_to_check":"- unknown","fix":"- Update iOS and iPadOS to 26.7 or 27.2, and macOS Tahoe to 26.7.2, macOS Sequoia to 15.8.2, or macOS Golden Gate to 27.2 as listed in the advisory.","status":"open","published_at":"2026-10-26T21:18:03+00:00","first_seen_at":"2026-10-26T21:20:30+00:00","triaged_at":"2026-10-26T21:23:27+00:00","updated_at":"2026-10-26T21:23:27+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-26T21:23:27Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to 26.7 or 27.2, and macOS Tahoe to 26.7.2, macOS Sequoia to 15.8.2, or macOS Golden Gate to 27.2 as listed in the advisory.","reach":"unknown","title":"Apple iOS and macOS: memory corruption when parsing a file","impact":"high","summary":"A memory corruption flaw in Apple's platforms can be triggered when a file is parsed, causing the app to crash or potentially run arbitrary code. The description does not name the affected component.","category":"vendor","nicknames":[],"who_cares":["apple","ios","macos","ipados"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Arbitrary code execution after parsing a crafted file.","analyst_note":"Check Apple's security notes for the affected component and the file types that trigger it; the NVD page cited in sources may not have the detail.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["fixed-os-version"],"who_is_affected":"Devices running the Apple OS versions earlier than the listed fixes. The sources do not say which file types or apps trigger the flaw, so the exposure path is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000566,"input_tokens":3329,"output_tokens":467,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112688':13A,16A '-2026':12A,15A '15.8.2':87C '26.7':72C,75C '26.7.2':90C '27.2':77C,80C,84C 'address':61C 'affect':54B 'app':40B,99C 'appl':1A,17B,27B 'arbitrari':46B,102C 'caus':38B 'code':47B,103C 'compon':55B 'corrupt':6A,24B,58C 'crash':42B 'cve':11A,14A 'descript':49B 'execut':104C 'file':10A,35B,93C 'fix':69C 'flaw':25B 'gate':83C 'golden':82C 'handl':65C 'improv':63C 'io':2A,18B,71C,76C 'ipado':19B,74C,79C 'issu':59C,67C 'lead':95C 'maco':4A,20B,81C,85C,88C 'may':94C 'memori':5A,23B,57C,64C 'name':52B 'pars':8A,37B,91C 'platform':29B 'potenti':44B 'run':45B 'sequoia':86C 'taho':89C 'termin':100C 'trigger':32B 'unexpect':98C 'vendor':21B","nicknames":[],"mitigations":[],"who_affected":"Devices running the Apple OS versions earlier than the listed fixes. The sources do not say which file types or apps trigger the flaw, so the exposure path is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112688","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112688","severity":null,"published_at":"2026-10-26T21:18:03+00:00","modified_at":"2026-10-26T21:18:03+00:00","first_seen_at":"2026-10-26T21:20:30+00:00","fetched_at":"2026-10-26T21:20:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}