APPLE-SA-10-26-2026-8 watchOS 27.2
Apple Product Security via Fulldisclosure ·
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-10-26-2026-8 watchOS 27.2 watchOS 27.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/149525. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Available for: Apple Watch Series 9 and later Impact: A malicious application may be able to bypass Privacy preferences Description: A logging issue was addressed with improved data redaction. CVE-2026-113898: Bhaswanth Chigurupati Accounts Available for: Apple Watch Series 9 and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with additional entitlement checks. CVE-2026-112446: LiangWei, Sindre Sorhus App Intents Available for: Apple Watch Series 9 and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with additional entitlement checks. CVE-2026-112692: Huy Nguyen (@34306) of Calif.io AppleAVD Available for: Apple Watch Series 9 and later Impact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-112454: @Licht_jb, Hcamael and 章鱼哥@aipy (aipyaipy.com) Audio Available for: Apple Watch Series 9 and later Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112546: lunar815, Surej Sekhar, Piotr Jerzy Duszynski, r3pwnx (@r3pwnx), an anonymous researcher, Lily Cohl (@GenericCoding), Nathaniel Oh (@calysteon) AVEVideoEncoder Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112470: Hcamael and 章鱼哥@aipy (aipyaipy.com) AVEVideoEncoder Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2026-112466: Hcamael and 章鱼哥@aipy (aipyaipy.com) Bluetooth Available for: Apple Watch Series 9 and later Impact: An attacker in physical proximity may be able to cause a denial-of-service Description: A null pointer dereference was addressed with improved validation. CVE-2026-112566: Chris Bailey - Short Circuit Calendar Available for: Apple Watch Series 9 and later Impact: An app may be able to access sensitive user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-112678: Neon, Niels Hofmans, Mustafa Calap (@ordinal0, dbg.re) Calendar Available for: Apple Watch Series 9 and later Impact: Processing a maliciously crafted calendar invitation may lead to memory corruption Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112619: Ivan Fratric of Google Project Zero ColorSync Available for: Apple Watch Series 9 and later Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: The issue was addressed with improved checks. CVE-2026-86988: Mateusz Jurczyk of Google Project Zero, Meta Red Team X - - Nik Tsytsarkin Compression Available for: Apple Watch Series 9 and later Impact: An app may be able to disclose kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-113910: Tucker Willenborg CoreAudio Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination or corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-113907: Meta Red Team X - Nik Tsytsarkin CoreAudio Available for: Apple Watch Series 9 and later Impact: Processing a maliciously crafted audio file may lead to memory corruption Description: A buffer overflow was addressed with improved size validation. CVE-2026-86972: an anonymous researcher, Meta Product Security CoreAudio Available for: Apple Watch Series 9 and later Impact: An attacker in radio range may be able to cause unexpected system termination Description: A heap buffer overflow was addressed with improved bounds checking. CVE-2026-112638: Përparim Mjeku, Altin Gashi, Altin Gashi CoreGraphics Available for: Apple Watch Series 9 and later Impact: Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-113950: Substrate, Stefan Esser (Calif) CoreMedia Available for: Apple Watch Series 9 and later Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: The issue was addressed with improved memory handling. CVE-2026-86992: Niels Hofmans CoreMedia Available for: Apple Watch Series 9 and later Impact: An app may be able to access sensitive user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-112706: Adriatik Raci, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Chris Bailey - Short Circuit CoreText Available for: Apple Watch Series 9 and later Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112656: Nurihan Kim (HanTul) working with TrendAI Zero Day Initiative FontParser Available for: Apple Watch Series 9 and later Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2026-86970: Hcamael and 章鱼哥@aipy (aipyaipy.com) FontParser Available for: Apple Watch Series 9 and later Impact: An app may be able to access sensitive user data Description: A logging issue was addressed with improved data redaction. CVE-2026-112432: D4rthL Heimdal Available for: Apple Watch Series 9 and later Impact: An attacker in a privileged network position may be able to impersonate a Kerberos KDC Description: An issue with signature validation was addressed with improved checks. CVE-2026-112518: Roman Zabicki, Tristan Madani (@TristanInSec) from Talence Security HomeKit Available for: Apple Watch Series 9 and later Impact: Processing a maliciously crafted video file may lead to unexpected system termination Description: An integer overflow was addressed with improved bounds checking. CVE-2026-112596: Garin R ImageIO Available for: Apple Watch Series 9 and later Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-112571: sh3rlock (김보겸) ImageIO Available for: Apple Watch Series 9 and later Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112561: Meta Red Team X - Nik Tsytsarkin CVE-2026-112560: Wout van der Ploeg (woutvanderploeg.nl) IOHIDFamily Available for: Apple Watch Series 9 and later Impact: An attacker may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112515: Charles Stevenson, Seung Je Seong, Mathis Mansière IOKit Available for: Apple Watch Series 9 and later Impact: A buffer overflow may result in memory corruption and unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-65385: Meta Red Team X - Nik Tsytsarkin IOMobileFrameBuffer Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A race condition was addressed with improved state handling. CVE-2026-112459: Lily Cohl (@GenericCoding), an anonymous researcher IOSurface Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A race condition was addressed with improved locking. CVE-2026-112477: an anonymous researcher Kernel Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected changes to copy-on-write memory Description: A memory integrity issue was addressed with improved handling of copy-on-write pages. CVE-2026-112576: Pedro Pinho Kernel Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination Description: A type confusion issue was addressed with improved memory handling. CVE-2026-112606: Wang Yu Kernel Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-65350: Nebula Security (@nebusecurity), Tim Michaud (@TimGMichaud) of Aginor.ai, Xinru Chi of Pangu Lab CVE-2026-112679: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-112517: Pasquale Scola, Wout van der Ploeg (woutvanderploeg.nl), John Lussier, Cem Onat Karagun, an anonymous researcher Kernel Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination Description: A use-after-free issue was addressed with improved memory management. CVE-2026-112516: greenbynox, an anonymous researcher Kernel Available for: Apple Watch Series 9 and later Impact: An attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-112514: Marc Newlin of SkySafe, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., greenbynox Kernel Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-84495: Wang Yu CVE-2026-112474: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with improved state handling. CVE-2026-112501: Cem Onat Karagun Kernel Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112476: Arnold Cartagena, Matt Suiche (@msuiche) of Tolmo Kernel Available for: Apple Watch Series 9 and later Impact: An app may be able to determine kernel memory layout Description: An information disclosure issue was addressed with improved state management. CVE-2026-112665: Will Estes MediaAnalysis Available for: Apple Watch Series 9 and later Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-113915: Abodi Dawoud, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Zhongquan Li (@Guluisacat), Ilya Andr (andrd3v) of Positive Technologies Messages Available for: Apple Watch Series 9 and later Impact: A remote attacker may be able to cause unexpected app termination Description: An input validation issue was addressed with improved input validation. CVE-2026-112682: Mahmoud Abdelmoniem Shortcuts Available for: Apple Watch Series 9 and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-112559: Lucas Lammer, Stuart Wallace CVE-2026-112455: Chris Bailey - Short Circuit, Rahul Raj Siri Available for: Apple Watch Series 9 and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-112685: silo, Abodi Dawoud Spotlight Available for: Apple Watch Series 9 and later Impact: An app may be able to gain elevated privileges Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. CVE-2022-26704: Joshua Mason of Mandiant, Gergely Kalman (@gergely_kalman) Spotlight Available for: Apple Watch Series 9 and later Impact: A malicious application may be able to bypass Privacy preferences Description: This issue was addressed with improved checks. CVE-2026-112567: zenith SwiftUI Available for: Apple Watch Series 9 and later Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-112691: @Licht_jb WebKit Available for: Apple Watch Series 9 and later Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 328114 CVE-2026-113904: Lily Cohl (@GenericCoding), Do Young Park (adawn), MYUNGYONG LEE, Luke Francis (@lukefr09), Shubham Chaskar, Kwak Kiyong, Song Nuri WebKit Bugzilla: 317465 CVE-2026-112599: Avinash Kumar Thapa & Jay Kaushik Patel WebKit Available for: Apple Watch Series 9 and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 322916 CVE-2026-112697: OpenAI Codex Security - Amy Burnett, 은태 장 WebKit Bugzilla: 324150 CVE-2026-112655: Euntae Jang WebKit Available for: Apple Watch Series 9 and later Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A race condition was addressed with improved locking. WebKit Bugzilla: 323986 CVE-2026-112686: an anonymous researcher WebKit Available for: Apple Watch Series 9 and later Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: This issue was addressed through improved state management. WebKit Bugzilla: 328132 CVE-2026-112684: Gia Bui (@yabeow) from Calif.io WebKit Available for: Apple Watch Series 9 and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A race condition was addressed with improved state handling. WebKit Bugzilla: 323173 CVE-2026-112669: remanone (@remanone_) WebKit Available for: Apple Watch Series 9 and later Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 321669 CVE-2026-112666: Luke Francis (@lukefr09) WebKit Bugzilla: 324735 CVE-2026-112615: Chris Rohlf with Anthropic Research WebKit Available for: Apple Watch Series 9 and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 324262 CVE-2026-112640: an anonymous researcher WebKit Canvas Available for: Apple Watch Series 9 and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 323377 CVE-2026-112637: Chris Rohlf with Anthropic Research, 은태 장 WebKit JavaScript Bindings Available for: Apple Watch Series 9 and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 328141 CVE-2026-112626: Euntae Jang, Luke Francis (@lukefr09), Shubham Chaskar, Josef Korbel (Citadelo) Additional recognition CoreAudio We would like to acknowledge Meta Product Security for their assistance. CoreCrypto We would like to acknowledge Niels Hofmans for their assistance. Foundation We would like to acknowledge Jaya Surya Kommireddy for their assistance. Kernel We would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Tristan Madani (@TristanInSec) from Talence Security for their assistance. libarchive We would like to acknowledge Muhammad Abdul Rehman, Owais Lone for their assistance. mDNSResponder We would like to acknowledge Aswin Kumar Gokula Kannan, Lucas Lammer, pixillated for their assistance. Sandbox Profiles We would like to acknowledge Ilya Andr (andrd3v) of Positive Technologies for their assistance. WebKit We would like to acknowledge Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Wael Alolowi for their assistance. Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmrfvRwACgkQ4Ifiq8DH 7PW9gxAAtYAYu9H4BklEt/CTwnCVMbRlJqi/xWJdeofDJYmwxB6VE8jnoZy0rxfD EuGVI0gHDlBJ0WXBrNWz0x9MEMzbsHXmeZDA0WCo2pIZdJuwZPLszJOFRt47lYP1 l8NsssqlGmtzEWpJUyHmUcf5COgI4dvKUwQu2795tFvIjnOi92an9M0jFksEddvK wIaob9kuuWLFAGMpA7HL4j02JCmwNCI90hytnUaBpiC9Pp0XNL4jtMGaeX71JTFr iFc/AC1yvd25sbCX0zSxEypEF5zNA+CIjD/d/cGX/giwQEH91EFTVDXMNSkoSHF6 YuRo5T84jlfixepBHRSZg9skfsSnJFxq1jMWH3jDKd8ZIsSH9V1Ohcbmi3hegyKC cWk90lpsBZPa3tcOy272r3eC/VgxyxY3nX2kRXiA+pNxBmEnoK3t6jCJnWXUhUyh NWh3RcubZV54kYxu75ovJ5+Vq1Kao5ngUBrsagVBPO7oTcXmif6flopE0hHqLh5u mhAdL+d70GfV53yeuPXy0OeaFThrTIlYUWsbp6eT44Vd2ljqwJ67oLQr9qO7xP7W lUMe7PY+Hyk1mwgE+YaWRX7pqZeKVV0zQkMIs/FN2RSuO10cXc73w8b2w5OSp14V FuaiqyzwecDLdXL8IcElYII6/X1pK1xPCY12TZilvZz9botoNC0= =Rn8w -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/