Live › vulnerability › CVE-2026-112699
Go to dashboardApple's WebKit engine in Safari and several iOS, iPadOS, macOS and visionOS releases has an out-of-bounds read that Apple fixed with better bounds checking. Processing maliciously crafted web content can disclose process memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Anyone browsing with Safari or another app that renders web content on the listed Apple OS versions is exposed, since the flaw is in content processing. Systems that do not run the listed Apple releases are not in scope. Teams that only manage servers can skip it.
No product ranges from the sources yet.
27.2 or later26.7.2 or 27.227.2 (Golden Gate) and visionOS to 27.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may result in the disclosure of process memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-112699")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.