APPLE-SA-10-26-2026-2 iOS 26.7.2 and iPadOS 26.7.2

Apple Product Security via Fulldisclosure · 2026-10-26

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-10-26-2026-2 iOS 26.7.2 and iPadOS 26.7.2

iOS 26.7.2 and iPadOS 26.7.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149227.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate Framework
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted image may lead to unexpected
app termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-86971: an anonymous researcher

AccessorySetupKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A malicious app may be able to access Bluetooth without user
consent
Description: An authentication issue was addressed with improved state
management.
CVE-2026-84493: Meta Red Team X - Nik Tsytsarkin

Accounts
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A malicious application may be able to bypass Privacy
preferences
Description: A logging issue was addressed with improved data redaction.
CVE-2026-113898: Bhaswanth Chigurupati

Accounts
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An attacker with physical access to a trust-paired device may be
able to read and write arbitrary files
Description: A path handling issue was addressed with improved
validation.
CVE-2026-112612: Johnny Franks (@0xjohnny), Daniel, KennethLi, an
anonymous researcher

App Store
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-113914: Jaebin Sim (simjabin () gmail com)

App Store
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A remote attacker may be able to break out of the WebContent
sandbox
Description: This issue was addressed with improved input validation.
CVE-2026-112690: Claudio Bozzato and Francesco Benvenuto of Cisco Talos

Apple Intelligence
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-86920: Johan Wahyudi

AppleAVD
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-112416: an anonymous researcher, Meta Red Team X - Nik
Tsytsarkin, Narendra Singh (@_3P1C), Hcamael and 章鱼哥@aipy
(aipyaipy.com), Dohyeon An @PILAB Technology, Inc

AppleAVD
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt process memory
Description: An out-of-bounds write was addressed with improved input
validation.
CVE-2026-112415: Rahul Raj, Hcamael and 章鱼哥@aipy (aipyaipy.com)

Audio
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-112546: lunar815, Nathaniel Oh (@calysteon), Piotr Jerzy
Duszynski, an anonymous researcher, Surej Sekhar, r3pwnx (@r3pwnx), Lily
Cohl (@GenericCoding)

AVEVideoEncoder
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-112705: Marco Schmitt, Andrey Chernykh, Josh Maine of Calif.io

AVEVideoEncoder
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds write issue was addressed with improved
input validation.
CVE-2026-112689: Franco Belman at Blackwing Intelligence

AVEVideoEncoder
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-112470: Hcamael and 章鱼哥@aipy (aipyaipy.com)
CVE-2026-112468: Hcamael and 章鱼哥@aipy (aipyaipy.com)
CVE-2026-112469: Hcamael and 章鱼哥@aipy (aipyaipy.com)

AVEVideoEncoder
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2026-112466: Hcamael and 章鱼哥@aipy (aipyaipy.com)

Bluetooth
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An attacker in physical proximity may be able to cause a
denial-of-service
Description: A null pointer dereference was addressed with improved
validation.
CVE-2026-112566: Chris Bailey - Short Circuit
CVE-2026-113906: Chris Bailey - Short Circuit

Calendar
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-112678: Neon, Niels Hofmans, Mustafa Calap (@ordinal0, dbg.re)

CloudKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-112701: N.M.Praveen Nawarathne (@zblockrat)

Compression
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to disclose kernel memory
Description: A memory initialization issue was addressed with improved
memory handling.
CVE-2026-113910: Tucker Willenborg

copyfile
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to modify protected parts of the file system
Description: This issue was addressed with improved handling of
symlinks.
CVE-2026-86966: Jihwan Yoon

CoreAudio
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: An out-of-bounds write was addressed with improved input
validation.
CVE-2026-86969: Meta Red Team X - Nik Tsytsarkin

CoreAudio
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt process memory
Description: A buffer overflow issue was addressed with improved memory
handling.
CVE-2026-113907: Meta Red Team X - Nik Tsytsarkin

CoreAudio
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An attacker in radio range may be able to cause unexpected
system termination
Description: A heap buffer overflow was addressed with improved bounds
checking.
CVE-2026-112638: Altin Gashi, Përparim Mjeku, Altin Gashi

CoreAudio
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted audio file may lead to memory
corruption
Description: A buffer overflow was addressed with improved size
validation.
CVE-2026-86972: an anonymous researcher, Meta Product Security

CoreGraphics
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted PDF file may lead to memory
corruption
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-112610: Meta Red Team X - Nik Tsytsarkin
CVE-2026-112611: f4&Zhiniang Peng with HUST, Aobo Wang (@M4x_1997),
Xiang Chen, Jakob Pammer, Anna Groza (@pwnlambda) of Calif.io, Piotr
Jerzy Duszynski, an anonymous researcher

CoreMedia
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted video file may lead to
unexpected app termination
Description: The issue was addressed with improved memory handling.
CVE-2026-86992: Niels Hofmans

CoreMedia
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with additional
restrictions.
CVE-2026-112706: Adriatik Raci, Chris Bailey - Short Circuit, Rodolphe
BRUNETTI (@eisw0lf) of Lupus Nova

CoreMedia
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A malicious app may be able to access the camera without user
permission
Description: An access issue was addressed with improved access
restrictions.
CVE-2026-86990: Mustafa Calap (@ordinal0, dbg.re)

CoreText
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-112656: Nurihan Kim (HanTul) working with TrendAI Zero Day
Initiative

FileProvider
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with additional validation.
CVE-2026-113896: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, R4mbb

FontParser
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2026-86970: Hcamael and 章鱼哥@aipy (aipyaipy.com)

FontParser
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted font may lead to unexpected app
termination or corrupt process memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-112683: Hcamael and 章鱼哥@aipy (aipyaipy.com)

FontParser
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-112642: Meta Red Team X - Nik Tsytsarkin

Heimdal
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-86942: He Wei (ギカク)

HFS
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted file may lead to heap
corruption
Description: An out-of-bounds write issue was addressed with improved
input validation.
CVE-2026-112456: Jihwan Yoon, Yash Pandya, Parth Raval

ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted image may lead to heap
corruption
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-84627: ธนกฤต ทัฬหะ, Mateusz Jurczyk of Google Project Zero, f0r
of MurphySec, PETOWORKS의 Bugeun Choi (@Bugeun), Piotr Jerzy Duszynski,
Rahul Raj

ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted image may corrupt process
memory
Description: A buffer overflow issue was addressed with improved memory
handling.
CVE-2026-112488: an anonymous researcher, Mateusz Jurczyk of Google
Project Zero, Nik Tsytsarkin

ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted image may result in memory
corruption
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-64750: Mateusz Jurczyk of Google Project Zero, Eddy
Tsalolikhin, Johann Rehberger

ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted image may result in disclosure
of process memory
Description: A memory initialization issue was addressed with improved
memory handling.
CVE-2026-112571: sh3rlock (김보겸)

ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted image may result in disclosure
of process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-112560: Wout van der Ploeg (woutvanderploeg.nl)
CVE-2026-112561: Meta Red Team X - Nik Tsytsarkin
CVE-2026-112627: Mateusz Jurczyk of Google Project Zero

ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-64759: XlabAI Team of Tencent Xuanwu Lab, Atuin Automated
Vulnerability Discovery Engine, Guannan Wang, Zhanpeng Liu, Jiashuo
Liang, Guancheng Li, Musaab Khan (@bxff), Iain Harkiss, Daniel Febrero

ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted image may lead to unexpected
app termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-86954: Mateusz Jurczyk of Google Project Zero
CVE-2026-112634: Mateusz Jurczyk of Google Project Zero
CVE-2026-112629: Mateusz Jurczyk of Google Project Zero

ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted image may result in disclosure
of process memory
Description: An uninitialized memory issue was addressed with improved
memory handling.
CVE-2026-112632: Mateusz Jurczyk of Google Project Zero
CVE-2026-112630: Mateusz Jurczyk of Google Project Zero

ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted image may result in memory
corruption
Description: An integer underflow was addressed with improved input
validation.
CVE-2026-112625: Mateusz Jurczyk of Google Project Zero

ImageIO
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted image may lead to unexpected
app termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-112633: Mateusz Jurczyk of Google Project Zero
CVE-2026-112614: Mateusz Jurczyk of Google Project Zero, PETOWORKS의
Bugeun Choi (@Bugeun), Rahul Raj, Piotr Jerzy Duszynski

IOHIDFamily
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An attacker may be able to cause unexpected system termination
or read kernel memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-112515: Charles Stevenson, Mathis Mansière, Seung Je Seong

IOKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A buffer overflow may result in memory corruption and unexpected
app termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-65385: Meta Red Team X - Nik Tsytsarkin

IOStorageFamily
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
read kernel memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-112554: Bhuwan Bhetwal, Kwak Kiyong (@Pwnkai23), Song Nuri,
Nicolas Seriot, Tommy DeVoss from Braze Security Team (@thedawgyg),
Tucker Willenborg, Navapon Premkasem, Aswin Kumar Gokulakannan, Peter
Malone, Richard Zana

IOSurface
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: A race condition was addressed with improved locking.
CVE-2026-112477: an anonymous researcher

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected changes to copy-on-write
memory
Description: A memory integrity issue was addressed with improved
handling of copy-on-write pages.
CVE-2026-112576: Pedro Pinho

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-84599: an anonymous researcher

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: A type confusion issue was addressed with improved memory
handling.
CVE-2026-112606: Wang Yu

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: The issue was addressed with improved memory handling.
CVE-2026-112698: OpenAI, Billy Jheng Bing Jhong and Pan Zhenpeng
(@Peterpan0927) of STAR Labs SG Pte. Ltd.

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-112476: Arnold Cartagena, Matt Suiche (@msuiche) of Tolmo

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: A use-after-free issue was addressed with improved memory
management.
CVE-2026-65350: Xinru Chi of Pangu Lab, Tim Michaud (@TimGMichaud) of
Aginor.ai, Nebula Security (@nebusecurity)

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A remote attacker may be able to bypass firewall rules
Description: This is a vulnerability in open source code and Apple
Software is among the affected projects. The CVE-ID was assigned by a
third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2019-5598

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: A use-after-free issue was addressed with improved memory
management.
CVE-2026-112516: an anonymous researcher, greenbynox

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt kernel memory
Description: A use after free issue was addressed with improved memory
management.
CVE-2026-112517: Pasquale Scola, Cem Onat Karagun, Wout van der Ploeg
(woutvanderploeg.nl), John Lussier, an anonymous researcher

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An attacker may be able to cause unexpected system termination
or corrupt kernel memory
Description: A use-after-free issue was addressed with improved memory
management.
CVE-2026-112514: Marc Newlin of SkySafe, Billy Jheng Bing Jhong and Pan
Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., greenbynox

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: A use-after-free issue was addressed with improved memory
management.
CVE-2026-84495: Wang Yu

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state
handling.
CVE-2026-112501: Cem Onat Karagun

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to determine kernel memory layout
Description: An information disclosure issue was addressed with improved
state management.
CVE-2026-112665: Will Estes

Kernel
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to bypass Privacy preferences
Description: This issue was addressed with improved checks.
CVE-2026-112624: Jerry L. Knot

libarchive
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-112522: Eliya M., Viacheslav Radiukov, Tristan Madani (Talence
Security), Robert Tran

LinkPresentation
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted image may result in memory
corruption
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-112621: Vinay Kumar Rasala (Xplo8E) from Appknox, an anonymous
researcher

Mail
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A remote attacker may be able to cause a denial-of-service
Description: A resource exhaustion issue was addressed with improved
input validation.
CVE-2026-112671: Nathaniel Oh (@calysteon)

Mail
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted message may lead to a
denial-of-service
Description: A stack overflow was addressed with improved input
validation.
CVE-2026-112414: Daniel Rodríguez, Nathaniel Oh (@calysteon)

Maps
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to identify what other apps a user has
installed
Description: A privacy issue was addressed by moving sensitive data to a
protected location.
CVE-2026-112707: Sindre Sorhus

MediaAnalysis
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: A race condition was addressed with additional validation.
CVE-2026-113915: Abodi Dawoud, Rodolphe BRUNETTI (@eisw0lf) of Lupus
Nova, Ilya Andr (andrd3v) of Positive Technologies, Zhongquan Li
(@Guluisacat)

MediaRemote
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with additional entitlement
checks.
CVE-2026-86880: Asaf Cohen

Messages
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A remote attacker may be able to cause unexpected app
termination
Description: An input validation issue was addressed with improved input
validation.
CVE-2026-112682: Mahmoud Abdelmoniem

MobileGestalt
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to fingerprint the user
Description: An authorization issue was addressed with improved state
management.
CVE-2026-86989: Ilya Andr (andrd3v) of Positive Technologies, Zhongcheng
Li (CK01)

Model I/O
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-112413: Nathaniel Oh (@calysteon)

Model I/O
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted 3D model may lead to memory
corruption
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-112461: 진규정 (Gyujeong Jin, @G1uN4sh), Lucas Parnell, Nathaniel
Oh (@calysteon), Meta Red Team X - Nik Tsytsarkin, YingMuo (@YingMuo) of
DEVCORE Research Team, ret2happy (@ret2happy)

Model I/O
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted 3D model may lead to memory
corruption
Description: An integer overflow was addressed with improved input
validation.
CVE-2026-112449: ret2happy (@ret2happy)

Model I/O
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a 3D model may lead to unexpected app termination
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-112486: Md Rasel Bhuyan (www.linkedin.com/in/rasel-bhuyan),
Musaab Khan (@bxff)

Photos Storage
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-65397: Varik Matevosyan (@D4RK7ET), an anonymous researcher

Photos Storage
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to bypass certain Privacy preferences
Description: An authorization issue was addressed with improved state
management.
CVE-2026-112660: Prafull Dhiman, Alto_00000

Photos Storage
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access a user's Photos Library
Description: This issue was addressed with additional entitlement
checks.
CVE-2026-112676: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova

Power Management
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to fingerprint the user
Description: This issue was addressed with additional entitlement
checks.
CVE-2026-112681: an anonymous researcher

RealityKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted file may lead to unexpected app
termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-112491: Hongsik Kim (mnur)

SceneKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a 3D model may result in disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-112425: stratan (@5tratan)

SceneKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted file may lead to a
denial-of-service or potentially disclose memory contents
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-112423: Rahul Raj

SceneKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted file may lead to heap
corruption
Description: An out-of-bounds write issue was addressed with improved
input validation.
CVE-2026-112464: 정우 하 (@0xfa11babe), Narendra Singh (@_3P1C)

SceneKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing a maliciously crafted file may lead to unexpected
process termination
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2026-86991: Cem Onat Karagun, Yujung Choi (@Dusker), Mathis
Mansière, Rahul Raj

Security
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing web content may disclose sensitive information
Description: An input validation issue was addressed with improved input
validation.
CVE-2026-113913: Niels Hofmans, Stav Nir and Vladimir Tokarev

Security
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to break out of its sandbox
Description: The issue was addressed with improved checks.
CVE-2026-65363: Arni Hardarson (Neonix Security), Csaba Fitzl
(@theevilbit) of Iru and Gergely Kalman (@gergely_kalman)

Security
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A local attacker may gain access to user's Keychain items
Description: This issue was addressed with improved permissions
checking.
CVE-2026-28864: Alex Radocea

Security
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An malicious app may be able to bypass certificate validation
Description: A logic issue was addressed with improved state management.
CVE-2026-112652: Aditya Kumar

Shortcuts
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state
management.
CVE-2026-112559: Lucas Lammer, Stuart Wallace
CVE-2026-112455: Rahul Raj, Chris Bailey - Short Circuit

Siri
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An attacker with physical access may be able to access contacts
from the lock screen
Description: A logic issue was addressed with improved checks.
CVE-2026-84614: Jagannath Mohanty

Spotlight
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data access
restriction.
CVE-2026-112628: Santiago Albertengo, Chris Bailey - Short Circuit

SpringBoard
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination or
corrupt process memory
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2026-112646: Meta Red Team X - Nik Tsytsarkin

SwiftUI
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved
input validation.
CVE-2026-112691: @Licht_jb

TextKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to read the device's name
Description: An authorization issue was addressed with improved state
management.
CVE-2026-84605: Sindre Sorhus

UIKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved state management.
CVE-2026-84594: Mohamad Dawoud

USB
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A malicious USB device may be able to cause unexpected system
termination or read kernel memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-112479: Rotce, Sandeep Wawdane (thecybersandeep), Marc Newlin
of SkySafe, Ankur Saini of Volexity, Kwak Kiyong (@Pwnkai23), Song nuri

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected process termination
Description: A race condition was addressed with improved locking.
WebKit Bugzilla: 323986
CVE-2026-112686: an anonymous researcher

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to memory
corruption
Description: A type confusion issue was addressed with improved checks.
WebKit Bugzilla: 321609
CVE-2026-86974: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 328114
CVE-2026-113904: Lily Cohl (@GenericCoding), Luke Francis (@lukefr09),
MYUNGYONG LEE, Shubham Chaskar, Do Young Park (adawn), Kwak Kiyong, Song
Nuri

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to arbitrary
code execution
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 322916
CVE-2026-112697: OpenAI Codex Security - Amy Burnett, 은태 장
WebKit Bugzilla: 322120
CVE-2026-112651: Euntae Jang
WebKit Bugzilla: 323265
CVE-2026-112623: pwn2addr, Lily Cohl (@GenericCoding)
WebKit Bugzilla: 324150
CVE-2026-112655: Euntae Jang

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 328131
CVE-2026-112693: 은태 장
WebKit Bugzilla: 318331
CVE-2026-86986: an anonymous researcher

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
WebKit Bugzilla: 323130
CVE-2026-112699: an anonymous researcher
WebKit Bugzilla: 323148
CVE-2026-112680: Franz Bettag, Kwak Kiyong, Song Nuri

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: This issue was addressed with improved input validation.
WebKit Bugzilla: 318522
CVE-2026-86985: Pasquale Scola

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected process termination
Description: A type confusion issue was addressed with improved state
handling.
WebKit Bugzilla: 322033
CVE-2026-112673: Myungyong Lee

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: This issue was addressed through improved state management.
WebKit Bugzilla: 328132
CVE-2026-112684: Gia Bui (@yabeow) from Calif.io

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to arbitrary
code execution
Description: A type confusion issue was addressed with improved memory
handling.
WebKit Bugzilla: 321982
CVE-2026-112659: OpenAI Codex Security - Amy Burnett, Chris Rohlf with
Anthropic Research

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected process termination
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 322671
CVE-2026-112695: Josef Korbel (Citadelo), Luke Francis (@lukefr09)
WebKit Bugzilla: 323227
CVE-2026-112653: Malik M. (@m411k_)
WebKit Bugzilla: 321934
CVE-2026-112654: Charles Kern
WebKit Bugzilla: 324735
CVE-2026-112615: Chris Rohlf with Anthropic Research

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to memory
corruption
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 324262
CVE-2026-112640: an anonymous researcher

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: A website may be able to use a media format that should be
restricted in Lockdown Mode
Description: A logic issue was addressed with improved checks.
WebKit Bugzilla: 324004
CVE-2026-113952: Drinor Selmanaj (Sentry)

WebKit
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to memory
corruption
Description: A type confusion issue was addressed with improved state
management.
WebKit Bugzilla: 323097
CVE-2026-113949: an anonymous researcher

WebKit JavaScript Bindings
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to arbitrary
code execution
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 328141
CVE-2026-112626: Luke Francis (@lukefr09), Shubham Chaskar, Josef Korbel
(Citadelo), Euntae Jang

WebKit Process Model
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to arbitrary
code execution
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 322743
CVE-2026-112639: Luke Francis (@lukefr09)

WebRTC
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: Processing maliciously crafted web content may lead to an
unexpected process crash
Description: An out-of-bounds read was addressed with improved bounds
checking.
WebKit Bugzilla: 323079
CVE-2026-86973: Narendra Singh (@_3P1C), an anonymous researcher

Wi-Fi
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An attacker in physical proximity may be able to corrupt process
memory
Description: A memory corruption issue was addressed with improved input
validation.
CVE-2026-113909: an anonymous researcher

Wi-Fi
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd
generation and later, iPad 8th generation and later, and iPad mini 5th
generation and later
Impact: An attacker in radio range may be able to cause unexpected
system termination
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2026-112622: Nathaniel Oh (@calysteon)

Additional recognition

Audio
We would like to acknowledge Narendra Singh (@_3P1C), Nathaniel Oh
(@calysteon) for their assistance.

AVEVideoEncoder
We would like to acknowledge Josh Maine of Calif.io for their
assistance.

Bluetooth
We would like to acknowledge John De Armas, an anonymous researcher for
their assistance.

CoreAudio
We would like to acknowledge Meta Product Security for their assistance.

Photos Storage
We would like to acknowledge Ilya Andr (andrd3v) of Positive
Technologies for their assistance.

Safari
We would like to acknowledge Azza Tegar Naufal Ataullah, Exell Nakano,
Zhiyang Zeng (@Wester), satrya wira yudha for their assistance.

WebKit
We would like to acknowledge an anonymous researcher for their
assistance.

This update is available through iTunes and Software Update on your iOS
device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes from
https://www.apple.com/itunes/

iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is presented
to the user when the iOS device is docked. We recommend applying the
update immediately if possible. Selecting Don't Install will present the
option the next time you connect your iOS device.

The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.

To check that the iPhone, iPod touch, or iPad has been updated:

* Navigate to Settings
* Select General
* Select About.
* The version after applying this update will be "iOS 26.7.2 and iPadOS
26.7.2".

All information is also posted on the Apple Security Releases
web site: https://support.apple.com/100100.

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmrfvJgACgkQ4Ifiq8DH
7PXWkBAAi+TAZdYZoPGzob2FUtEnkVJmc6oossrDup/ftunLgXMLyQ30ZXh/a00H
0Of3FLfnuatCebGLfV3jIUpPyjOTilRSBa1LL4GKHLelp/kZiFhjleyz5rt21WIT
/lMGsUCWbhTk+o+G95bXnLKNo/d6uMlgesLRQF+xh8iTSsvPCy+ufH8M5/DeN8uz
3Vz74O+cTbsedCMYqJFO9PMhhQDwMQVRk3fPuiH/JSeyaG0h83PdXDAOPjV2rD9z
+87mCDJuY88f0PR2VDi1lI0G7/XMX4E1btQeJeKVKHGGRvOuOKwHFYBvAJZLdN95
ia8IYdn/sdp0TNsopKYgbsnkbNHXaul4SiX+WwDywOsp7BKPU/vr31iDc+4tlHkP
svm1fOZy3YyQ88DM2+7sP/sF61/7A0zPaSEyaDXzZRToEWfSKGcIca+R368AZbVz
0KAnHsHfsEr/9B0XctC6NDRXUgTjo+yWv68CTTruWGUxKJhpiiz7QltS/H2f8f1G
hd2ukKjuNKt9DpaGDpx+eAYGSA4eC3JiWeH0myZSyl2oAZLrernBip51J+Hz/tE3
r73Eo+OVwhqddClM2hhyE9AF0Saj8NdXCLRZKAovKMw17Bb992hS6t2JUL5Mo3GG
71Z3Gw2Dz+NqZP5EzU75C/vhlfxaJ3xbE8OabfTe/Oh7IkVmakE=
=1fOq
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/