APPLE-SA-10-26-2026-7 tvOS 27.2
Apple Product Security via Fulldisclosure ·
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-10-26-2026-7 tvOS 27.2 tvOS 27.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/149524. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Available for: Apple TV 4K 2nd generation and later Impact: A malicious application may be able to bypass Privacy preferences Description: A logging issue was addressed with improved data redaction. CVE-2026-113898: Bhaswanth Chigurupati Accounts Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with additional entitlement checks. CVE-2026-112446: LiangWei, Sindre Sorhus App Intents Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with additional entitlement checks. CVE-2026-112692: Huy Nguyen (@34306) of Calif.io AppleAVD Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112416: an anonymous researcher, Dohyeon An @PILAB Technology, Inc, Hcamael and 章鱼哥@aipy (aipyaipy.com), Narendra Singh (@_3P1C), Meta Red Team X - Nik Tsytsarkin AppleAVD Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-112454: @Licht_jb, Hcamael and 章鱼哥@aipy (aipyaipy.com) Audio Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112546: lunar815, Surej Sekhar, Piotr Jerzy Duszynski, r3pwnx (@r3pwnx), an anonymous researcher, Lily Cohl (@GenericCoding), Nathaniel Oh (@calysteon) AVEVideoEncoder Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112705: Marco Schmitt, Andrey Chernykh, Josh Maine of Calif.io AVEVideoEncoder Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-112689: Franco Belman at Blackwing Intelligence AVEVideoEncoder Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112470: Hcamael and 章鱼哥@aipy (aipyaipy.com) CVE-2026-112469: Hcamael and 章鱼哥@aipy (aipyaipy.com) CVE-2026-112468: Hcamael and 章鱼哥@aipy (aipyaipy.com) AVEVideoEncoder Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2026-112466: Hcamael and 章鱼哥@aipy (aipyaipy.com) Bluetooth Available for: Apple TV 4K 2nd generation and later Impact: An attacker in physical proximity may be able to cause a denial-of-service Description: A null pointer dereference was addressed with improved validation. CVE-2026-112566: Chris Bailey - Short Circuit ColorSync Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: The issue was addressed with improved checks. CVE-2026-86988: Mateusz Jurczyk of Google Project Zero, Meta Red Team X - - Nik Tsytsarkin Compression Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to disclose kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-113910: Tucker Willenborg CoreAudio Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-113912: an anonymous researcher, 章鱼哥@aipy (aipyaipy.com), Roman Zabicki, Anna Groza (@pwnlambda) of Calif.io CoreAudio Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination or corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-113907: Meta Red Team X - Nik Tsytsarkin CoreAudio Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted audio file may lead to memory corruption Description: A buffer overflow was addressed with improved size validation. CVE-2026-86972: an anonymous researcher, Meta Product Security CoreAudio Available for: Apple TV 4K 2nd generation and later Impact: An attacker in radio range may be able to cause unexpected system termination Description: A heap buffer overflow was addressed with improved bounds checking. CVE-2026-112638: Përparim Mjeku, Altin Gashi, Altin Gashi CoreGraphics Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-113950: Substrate, Stefan Esser (Calif) CoreMedia Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: The issue was addressed with improved memory handling. CVE-2026-86992: Niels Hofmans CoreMedia Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to access sensitive user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-112706: Adriatik Raci, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Chris Bailey - Short Circuit CoreText Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112656: Nurihan Kim (HanTul) working with TrendAI Zero Day Initiative FontParser Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2026-86970: Hcamael and 章鱼哥@aipy (aipyaipy.com) FontParser Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112642: Meta Red Team X - Nik Tsytsarkin FontParser Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to access sensitive user data Description: A logging issue was addressed with improved data redaction. CVE-2026-112432: D4rthL Heimdal Available for: Apple TV 4K 2nd generation and later Impact: An attacker in a privileged network position may be able to impersonate a Kerberos KDC Description: An issue with signature validation was addressed with improved checks. CVE-2026-112518: Roman Zabicki, Tristan Madani (@TristanInSec) from Talence Security HomeKit Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-86978: Garin R HomeKit Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted video file may lead to unexpected system termination Description: An integer overflow was addressed with improved bounds checking. CVE-2026-112596: Garin R ImageIO Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-112571: sh3rlock (김보겸) ImageIO Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112561: Meta Red Team X - Nik Tsytsarkin CVE-2026-112560: Wout van der Ploeg (woutvanderploeg.nl) IOHIDFamily Available for: Apple TV 4K 2nd generation and later Impact: An attacker may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112515: Charles Stevenson, Seung Je Seong, Mathis Mansière IOMobileFrameBuffer Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A race condition was addressed with improved state handling. CVE-2026-112459: Lily Cohl (@GenericCoding), an anonymous researcher IOSurface Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A race condition was addressed with improved locking. CVE-2026-112477: an anonymous researcher Kernel Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected changes to copy-on-write memory Description: A memory integrity issue was addressed with improved handling of copy-on-write pages. CVE-2026-112576: Pedro Pinho Kernel Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination Description: A type confusion issue was addressed with improved memory handling. CVE-2026-112606: Wang Yu Kernel Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-65350: Nebula Security (@nebusecurity), Tim Michaud (@TimGMichaud) of Aginor.ai, Xinru Chi of Pangu Lab CVE-2026-112679: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-112517: Pasquale Scola, Wout van der Ploeg (woutvanderploeg.nl), John Lussier, Cem Onat Karagun, an anonymous researcher Kernel Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination Description: A use-after-free issue was addressed with improved memory management. CVE-2026-112516: greenbynox, an anonymous researcher Kernel Available for: Apple TV 4K 2nd generation and later Impact: An attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-112514: Marc Newlin of SkySafe, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., greenbynox Kernel Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-84495: Wang Yu CVE-2026-112474: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with improved state handling. CVE-2026-112501: Cem Onat Karagun Kernel Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112476: Arnold Cartagena, Matt Suiche (@msuiche) of Tolmo Kernel Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to determine kernel memory layout Description: An information disclosure issue was addressed with improved state management. CVE-2026-112665: Will Estes MediaAnalysis Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-113915: Abodi Dawoud, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Zhongquan Li (@Guluisacat), Ilya Andr (andrd3v) of Positive Technologies MediaRemote Available for: Apple TV 4K 2nd generation and later Impact: An attacker on the local network may be able to cause unexpected system termination or corrupt process memory Description: This issue was addressed by removing the vulnerable code. CVE-2026-112687: Azize Rhounam, Rahul Raj Model I/O Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112563: stratan (@5tratan) Model I/O Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted 3D model may lead to memory corruption Description: The issue was addressed with improved memory handling. CVE-2026-112485: Nik Tsytsarkin RealityKit Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112491: Hongsik Kim (mnur) SceneKit Available for: Apple TV 4K 2nd generation and later Impact: Processing a 3D model may result in disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112425: stratan (@5tratan) SceneKit Available for: Apple TV 4K 2nd generation and later Impact: Processing a maliciously crafted file may lead to heap corruption Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-112464: 정우 하 (@0xfa11babe), Narendra Singh (@_3P1C) Shortcuts Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-112455: Chris Bailey - Short Circuit, Rahul Raj Siri Available for: Apple TV 4K 2nd generation and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-112685: silo, Abodi Dawoud Spotlight Available for: Apple TV 4K 2nd generation and later Impact: A malicious application may be able to bypass Privacy preferences Description: This issue was addressed with improved checks. CVE-2026-112567: zenith Thread Available for: Apple TV 4K 2nd generation and later Impact: An attacker in physical proximity may be able to craft malicious network traffic to gain access to a Thread network Description: This issue was addressed with improved authentication. CVE-2026-112595: Wesley Wineberg WebKit Available for: Apple TV 4K 2nd generation and later Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 328114 CVE-2026-113904: Lily Cohl (@GenericCoding), Do Young Park (adawn), MYUNGYONG LEE, Luke Francis (@lukefr09), Shubham Chaskar, Kwak Kiyong, Song Nuri WebKit Bugzilla: 317465 CVE-2026-112599: Avinash Kumar Thapa & Jay Kaushik Patel WebKit Available for: Apple TV 4K 2nd generation and later Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: This issue was addressed with improved input validation. WebKit Bugzilla: 318522 CVE-2026-86985: Pasquale Scola WebKit Available for: Apple TV 4K 2nd generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 322916 CVE-2026-112697: OpenAI Codex Security - Amy Burnett, 은태 장 WebKit Bugzilla: 324150 CVE-2026-112655: Euntae Jang WebKit Available for: Apple TV 4K 2nd generation and later Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A race condition was addressed with improved locking. WebKit Bugzilla: 323986 CVE-2026-112686: an anonymous researcher WebKit Available for: Apple TV 4K 2nd generation and later Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: This issue was addressed through improved state management. WebKit Bugzilla: 328132 CVE-2026-112684: Gia Bui (@yabeow) from Calif.io WebKit Available for: Apple TV 4K 2nd generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A race condition was addressed with improved state handling. WebKit Bugzilla: 323173 CVE-2026-112669: remanone (@remanone_) WebKit Available for: Apple TV 4K 2nd generation and later Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 321669 CVE-2026-112666: Luke Francis (@lukefr09) WebKit Bugzilla: 324735 CVE-2026-112615: Chris Rohlf with Anthropic Research WebKit Available for: Apple TV 4K 2nd generation and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 324262 CVE-2026-112640: an anonymous researcher WebKit Canvas Available for: Apple TV 4K 2nd generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 323377 CVE-2026-112637: Chris Rohlf with Anthropic Research, 은태 장 WebKit JavaScript Bindings Available for: Apple TV 4K 2nd generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 328141 CVE-2026-112626: Euntae Jang, Luke Francis (@lukefr09), Shubham Chaskar, Josef Korbel (Citadelo) Wi-Fi Available for: Apple TV 4K 2nd generation and later Impact: An attacker in a privileged network position may be able to cause a denial-of-service Description: A denial-of-service issue was addressed with improved input validation. CVE-2026-112620: Nathaniel Oh (@calysteon) Additional recognition Audio We would like to acknowledge Nathaniel Oh (@calysteon) for their assistance. AVEVideoEncoder We would like to acknowledge Josh Maine of Calif.io, Narendra Singh (@_3P1C) for their assistance. CoreAudio We would like to acknowledge Meta Product Security for their assistance. CoreCrypto We would like to acknowledge Niels Hofmans for their assistance. Foundation We would like to acknowledge Jaya Surya Kommireddy for their assistance. Kernel We would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Tristan Madani (@TristanInSec) from Talence Security for their assistance. libarchive We would like to acknowledge Muhammad Abdul Rehman, Owais Lone for their assistance. mDNSResponder We would like to acknowledge Aswin Kumar Gokula Kannan, Lucas Lammer, pixillated for their assistance. Sandbox Profiles We would like to acknowledge Ilya Andr (andrd3v) of Positive Technologies for their assistance. WebKit We would like to acknowledge Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Stan Shaw, Volodymyr Diachenko, Wael Alolowi for their assistance. Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> System -> Software Update -> Update Software." To check the current version of software, select "Settings -> General -> About." All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmrfvQkACgkQ4Ifiq8DH 7PURuw/9HOPYpDBNWjccLXmjH6HnatB43ICxyaFuSJSHRn/Q3tgFy+aFOENIOrfc 8WVWXcLOPWeBv/JDKkTeaQ+wzkj5zz3jAthJM8zybOnLZkrieVxWyAd5QV6NOyI4 XOw/sDFD0kmTtepRUFDgFkcTXu5Ghi04Jyot2XAYe61npRUZ1S7/ACtkz+tTxuJK Aqwl5OY9mEmoGJoUFXjo16bO3cUaqQRt4JPia57YIdhDd/9cimqO64fQmFT568CK NtFjnzfZ6UBuoU78+yeIjYh2uzWksus9/xrUgFBd/KMkf1/kZ1e5kyP4D0hStqN9 BRhTMIm+wQoqmAGUYi592ppPNxxhHCdgC6Sqnjk6T7oLpKXb5tJ8yTUEpSQakGAk If7sZxWK6W6COzv9KsOV+mKvlBzb6pdl6He1aMTL7kJI5Eg4hLDvgXTM1xyppKtm Vq7USVZDT1hku/Ipk6vkmIekWb/RjajhzbiU0jNFtSXWpG3ouB+dUEawf90lVEOT bXZae2RPCCRUTlXsdPmBqF3jYummAJa1XG5f/7zUCuN8yLqlW7pDBWRMREqaWmLy UAyP4OaGMeeqMqJsxzL1fjq9MsnSrxI+1EB9LzbOQudEa3a9NRGcAYoLiGM9Nf/4 PBFT2OWzi2GndqMWYmIMdRQ69Xoq3xgEOImmtyMJI8b6V5m6IrY= =fwEE -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/