APPLE-SA-10-26-2026-9 visionOS 27.2
Apple Product Security via Fulldisclosure ·
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-10-26-2026-9 visionOS 27.2 visionOS 27.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/149526. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accelerate Framework Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86971: an anonymous researcher Accounts Available for: Apple Vision Pro (all models) Impact: A malicious application may be able to bypass Privacy preferences Description: A logging issue was addressed with improved data redaction. CVE-2026-113898: Bhaswanth Chigurupati Accounts Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed with additional entitlement checks. CVE-2026-112446: LiangWei, Sindre Sorhus App Intents Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed with additional entitlement checks. CVE-2026-112692: Huy Nguyen (@34306) of Calif.io App Store Available for: Apple Vision Pro (all models) Impact: A remote attacker may be able to break out of the WebContent sandbox Description: This issue was addressed with improved input validation. CVE-2026-112690: Claudio Bozzato and Francesco Benvenuto of Cisco Talos Apple Neural Engine Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112696: Jaeyeong Lee Apple Neural Engine Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84494: Meta Red Team X - Nik Tsytsarkin AppleAVD Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112416: an anonymous researcher, Dohyeon An @PILAB Technology, Inc, Hcamael and 章鱼哥@aipy (aipyaipy.com), Narendra Singh (@_3P1C), Meta Red Team X - Nik Tsytsarkin AppleAVD Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt process memory Description: An out-of-bounds write was addressed with improved input validation. CVE-2026-112415: Hcamael and 章鱼哥@aipy (aipyaipy.com), Rahul Raj AppleAVD Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-112454: @Licht_jb, Hcamael and 章鱼哥@aipy (aipyaipy.com) Audio Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112546: lunar815, Surej Sekhar, Piotr Jerzy Duszynski, r3pwnx (@r3pwnx), an anonymous researcher, Lily Cohl (@GenericCoding), Nathaniel Oh (@calysteon) AVEVideoEncoder Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112470: Hcamael and 章鱼哥@aipy (aipyaipy.com) CVE-2026-112469: Hcamael and 章鱼哥@aipy (aipyaipy.com) CVE-2026-112468: Hcamael and 章鱼哥@aipy (aipyaipy.com) AVEVideoEncoder Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2026-112466: Hcamael and 章鱼哥@aipy (aipyaipy.com) Bluetooth Available for: Apple Vision Pro (all models) Impact: An attacker in physical proximity may be able to cause a denial-of-service Description: A null pointer dereference was addressed with improved validation. CVE-2026-112566: Chris Bailey - Short Circuit Calendar Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-112678: Neon, Niels Hofmans, Mustafa Calap (@ordinal0, dbg.re) Calendar Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted calendar invitation may lead to memory corruption Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112619: Ivan Fratric of Google Project Zero ColorSync Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: The issue was addressed with improved checks. CVE-2026-86988: Mateusz Jurczyk of Google Project Zero, Meta Red Team X - - Nik Tsytsarkin Compression Available for: Apple Vision Pro (all models) Impact: An app may be able to disclose kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-113910: Tucker Willenborg CoreAudio Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-113912: an anonymous researcher, 章鱼哥@aipy (aipyaipy.com), Roman Zabicki, Anna Groza (@pwnlambda) of Calif.io CoreAudio Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-113907: Meta Red Team X - Nik Tsytsarkin CoreAudio Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted audio file may lead to memory corruption Description: A buffer overflow was addressed with improved size validation. CVE-2026-86972: an anonymous researcher, Meta Product Security CoreAudio Available for: Apple Vision Pro (all models) Impact: An attacker in radio range may be able to cause unexpected system termination Description: A heap buffer overflow was addressed with improved bounds checking. CVE-2026-112638: Përparim Mjeku, Altin Gashi, Altin Gashi CoreGraphics Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-113950: Substrate, Stefan Esser (Calif) CoreMedia Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: The issue was addressed with improved memory handling. CVE-2026-86992: Niels Hofmans CoreMedia Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-112706: Adriatik Raci, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Chris Bailey - Short Circuit CoreMedia Available for: Apple Vision Pro (all models) Impact: A malicious app may be able to access the camera without user permission Description: An access issue was addressed with improved access restrictions. CVE-2026-86990: Mustafa Calap (@ordinal0, dbg.re) CoreText Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112656: Nurihan Kim (HanTul) working with TrendAI Zero Day Initiative FileProvider Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-113896: R4mbb, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova Files Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: An access issue was addressed with improved access restrictions. CVE-2026-112618: Somair Ansar, Abodi Dawoud FontParser Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2026-86970: Hcamael and 章鱼哥@aipy (aipyaipy.com) FontParser Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112683: Hcamael and 章鱼哥@aipy (aipyaipy.com) FontParser Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112642: Meta Red Team X - Nik Tsytsarkin FontParser Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: A logging issue was addressed with improved data redaction. CVE-2026-112432: D4rthL Heimdal Available for: Apple Vision Pro (all models) Impact: An attacker in a privileged network position may be able to impersonate a Kerberos KDC Description: An issue with signature validation was addressed with improved checks. CVE-2026-112518: Roman Zabicki, Tristan Madani (@TristanInSec) from Talence Security HomeKit Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted video file may lead to unexpected system termination Description: An integer overflow was addressed with improved bounds checking. CVE-2026-112596: Garin R ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-112571: sh3rlock (김보겸) ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112561: Meta Red Team X - Nik Tsytsarkin CVE-2026-112560: Wout van der Ploeg (woutvanderploeg.nl) CVE-2026-112627: Mateusz Jurczyk of Google Project Zero ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-112488: Mateusz Jurczyk of Google Project Zero, Nik Tsytsarkin, an anonymous researcher ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may lead to unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112634: Mateusz Jurczyk of Google Project Zero CVE-2026-112629: Mateusz Jurczyk of Google Project Zero ImageIO Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: An uninitialized memory issue was addressed with improved memory handling. CVE-2026-112632: Mateusz Jurczyk of Google Project Zero IOHIDFamily Available for: Apple Vision Pro (all models) Impact: An attacker may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112515: Charles Stevenson, Seung Je Seong, Mathis Mansière IOKit Available for: Apple Vision Pro (all models) Impact: A buffer overflow may result in memory corruption and unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-65385: Meta Red Team X - Nik Tsytsarkin IOSurface Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A race condition was addressed with improved locking. CVE-2026-112477: an anonymous researcher Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected changes to copy-on-write memory Description: A memory integrity issue was addressed with improved handling of copy-on-write pages. CVE-2026-112576: Pedro Pinho Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: A type confusion issue was addressed with improved memory handling. CVE-2026-112606: Wang Yu Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-65350: Nebula Security (@nebusecurity), Tim Michaud (@TimGMichaud) of Aginor.ai, Xinru Chi of Pangu Lab CVE-2026-112679: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-112517: Pasquale Scola, Wout van der Ploeg (woutvanderploeg.nl), John Lussier, Cem Onat Karagun, an anonymous researcher Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: A use-after-free issue was addressed with improved memory management. CVE-2026-112516: greenbynox, an anonymous researcher Kernel Available for: Apple Vision Pro (all models) Impact: An attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-112514: Marc Newlin of SkySafe, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., greenbynox Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-84495: Wang Yu CVE-2026-112474: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with improved state handling. CVE-2026-112501: Cem Onat Karagun Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112476: Arnold Cartagena, Matt Suiche (@msuiche) of Tolmo Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to determine kernel memory layout Description: An information disclosure issue was addressed with improved state management. CVE-2026-112665: Will Estes Kernel Available for: Apple Vision Pro (all models) Impact: An app may be able to bypass Privacy preferences Description: This issue was addressed with improved checks. CVE-2026-112624: Jerry L. Knot LinkPresentation Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted image may result in memory corruption Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112621: Vinay Kumar Rasala (Xplo8E) from Appknox, an anonymous researcher Mail Available for: Apple Vision Pro (all models) Impact: The user's original email address may be leaked when using the Hide My Email feature Description: A logic issue was addressed with improved restrictions. CVE-2026-112500 Mail Available for: Apple Vision Pro (all models) Impact: A remote attacker may be able to cause a denial-of-service Description: A resource exhaustion issue was addressed with improved input validation. CVE-2026-112671: Nathaniel Oh (@calysteon) Mail Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted message may lead to a denial-of-service Description: A stack overflow was addressed with improved input validation. CVE-2026-112414: Daniel Rodríguez, Nathaniel Oh (@calysteon) MediaAnalysis Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-113915: Abodi Dawoud, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Zhongquan Li (@Guluisacat), Ilya Andr (andrd3v) of Positive Technologies Messages Available for: Apple Vision Pro (all models) Impact: A remote attacker may be able to cause unexpected app termination Description: An input validation issue was addressed with improved input validation. CVE-2026-112682: Mahmoud Abdelmoniem Model I/O Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted 3D model may lead to memory corruption Description: An integer overflow was addressed with improved input validation. CVE-2026-112565: Musaab Khan (@bxff), Saoud Khalifah, stratan (@5tratan), Hcamael and 章鱼哥@aipy (aipyaipy.com), Niels Hofmans CVE-2026-112449: ret2happy (@ret2happy) Model I/O Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112563: stratan (@5tratan) Model I/O Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112413: Nathaniel Oh (@calysteon) Model I/O Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted 3D model may lead to memory corruption Description: The issue was addressed with improved memory handling. CVE-2026-112485: Nik Tsytsarkin Model I/O Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted 3D model may lead to memory corruption Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112461: 진규정 (Gyujeong Jin, @G1uN4sh), Lucas Parnell, ret2happy (@ret2happy), Meta Red Team X - Nik Tsytsarkin, YingMuo (@YingMuo) of DEVCORE Research Team, Nathaniel Oh (@calysteon) Model I/O Available for: Apple Vision Pro (all models) Impact: Processing a 3D model may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112486: Md Rasel Bhuyan (www.linkedin.com/in/rasel-bhuyan), Musaab Khan (@bxff) Photos Storage Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-65397: Varik Matevosyan (@D4RK7ET), an anonymous researcher Photos Storage Available for: Apple Vision Pro (all models) Impact: An app may be able to access a user's Photos Library Description: This issue was addressed with additional entitlement checks. CVE-2026-112676: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova Photos Storage Available for: Apple Vision Pro (all models) Impact: An app may be able to bypass certain Privacy preferences Description: An authorization issue was addressed with improved state management. CVE-2026-112660: Prafull Dhiman, Alto_00000 Quick Look Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-86925: JeongAhn Jang, Alto_00000, Nicolas Seriot, 김도현, Abodi Dawoud, Drin Raci of sentry.security, Jakob Pammer, Stuart Wallace, hamayanhamayan, Vinay Kumar Rasala (Xplo8E) from Appknox, Daniel Rodríguez, Ilya Andr (andrd3v), Rahul Raj, Mustafa Calap (@ordinal0, dbg.re) RealityKit Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted 3D model may lead to memory corruption Description: An integer overflow was addressed with improved input validation. CVE-2026-112417: YingMuo (@YingMuo) of DEVCORE Research Team, Nathaniel Oh (@calysteon) RealityKit Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112491: Hongsik Kim (mnur) SceneKit Available for: Apple Vision Pro (all models) Impact: Processing a 3D model may result in disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112425: stratan (@5tratan) SceneKit Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112423: Rahul Raj SceneKit Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to heap corruption Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-112464: 정우 하 (@0xfa11babe), Narendra Singh (@_3P1C) SceneKit Available for: Apple Vision Pro (all models) Impact: Processing a maliciously crafted file may lead to unexpected process termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-86991: Cem Onat Karagun, Yujung Choi (@Dusker), Mathis Mansière, Rahul Raj Screen Time Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved access control. CVE-2026-112616: Drin Raci of sentry.security, Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0, dbg.re), Robert Mindo, N.M.Praveen Nawarathne (@zblockrat), Ilya Andr (andrd3v), Sindre Sorhus Security Available for: Apple Vision Pro (all models) Impact: Processing web content may disclose sensitive information Description: An input validation issue was addressed with improved input validation. CVE-2026-113913: Niels Hofmans, Stav Nir and Vladimir Tokarev Security Available for: Apple Vision Pro (all models) Impact: An malicious app may be able to bypass certificate validation Description: A logic issue was addressed with improved state management. CVE-2026-112652: Aditya Kumar Shortcuts Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-112559: Lucas Lammer, Stuart Wallace CVE-2026-112455: Chris Bailey - Short Circuit, Rahul Raj Siri Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-112685: silo, Abodi Dawoud Spotlight Available for: Apple Vision Pro (all models) Impact: An app may be able to gain elevated privileges Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. CVE-2022-26704: Joshua Mason of Mandiant, Gergely Kalman (@gergely_kalman) Spotlight Available for: Apple Vision Pro (all models) Impact: A malicious application may be able to bypass Privacy preferences Description: This issue was addressed with improved checks. CVE-2026-112567: zenith Spotlight Available for: Apple Vision Pro (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data access restriction. CVE-2026-112628: Santiago Albertengo, Chris Bailey - Short Circuit SpringBoard Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination or corrupt process memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112646: Meta Red Team X - Nik Tsytsarkin SwiftUI Available for: Apple Vision Pro (all models) Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-112691: @Licht_jb System Preferences Available for: Apple Vision Pro (all models) Impact: A malicious app may be able to access restricted system interfaces or launder launch attribution Description: An access issue was addressed with improved access control. CVE-2026-86968: Sindre Sorhus WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 328114 CVE-2026-113904: Lily Cohl (@GenericCoding), Do Young Park (adawn), MYUNGYONG LEE, Luke Francis (@lukefr09), Shubham Chaskar, Kwak Kiyong, Song Nuri WebKit Bugzilla: 317465 CVE-2026-112599: Avinash Kumar Thapa & Jay Kaushik Patel WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to memory corruption Description: A type confusion issue was addressed with improved checks. WebKit Bugzilla: 321609 CVE-2026-86974: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 318331 CVE-2026-86986: an anonymous researcher WebKit Bugzilla: 328131 CVE-2026-112693: 은태 장 WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. WebKit Bugzilla: 323130 CVE-2026-112699: an anonymous researcher WebKit Bugzilla: 323148 CVE-2026-112680: Franz Bettag, Kwak Kiyong, Song Nuri WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 322916 CVE-2026-112697: OpenAI Codex Security - Amy Burnett, 은태 장 WebKit Bugzilla: 324150 CVE-2026-112655: Euntae Jang WebKit Bugzilla: 322120 CVE-2026-112651: Euntae Jang WebKit Bugzilla: 323265 CVE-2026-112623: pwn2addr, Lily Cohl (@GenericCoding) WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A race condition was addressed with improved locking. WebKit Bugzilla: 323986 CVE-2026-112686: an anonymous researcher WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: This issue was addressed through improved state management. WebKit Bugzilla: 328132 CVE-2026-112684: Gia Bui (@yabeow) from Calif.io WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A type confusion issue was addressed with improved state handling. WebKit Bugzilla: 322033 CVE-2026-112673: Myungyong Lee WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A type confusion issue was addressed with improved memory handling. WebKit Bugzilla: 321982 CVE-2026-112659: OpenAI Codex Security - Amy Burnett, Chris Rohlf with Anthropic Research WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 322671 CVE-2026-112695: Josef Korbel (Citadelo), Luke Francis (@lukefr09) WebKit Bugzilla: 321934 CVE-2026-112654: Charles Kern WebKit Bugzilla: 323227 CVE-2026-112653: Malik M. (@m411k_) WebKit Bugzilla: 324735 CVE-2026-112615: Chris Rohlf with Anthropic Research WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to memory corruption Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 324262 CVE-2026-112640: an anonymous researcher WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to memory corruption Description: A type confusion issue was addressed with improved state management. WebKit Bugzilla: 323097 CVE-2026-113949: an anonymous researcher WebKit Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to unexpected memory modification Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 321652 CVE-2026-113903: Eddy Tsalolikhin, OpenAI Codex Security - Amy Burnett, Lily Cohl (@GenericCoding) WebKit Canvas Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 323377 CVE-2026-112637: Chris Rohlf with Anthropic Research, 은태 장 WebKit JavaScript Bindings Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 328141 CVE-2026-112626: Euntae Jang, Luke Francis (@lukefr09), Shubham Chaskar, Josef Korbel (Citadelo) WebKit Process Model Available for: Apple Vision Pro (all models) Impact: A remote attacker may be able to break out of Web Content sandbox Description: This issue was addressed by removing the vulnerable code. WebKit Bugzilla: 328129 CVE-2026-113897: Luke Francis, Jackson Kuja WebKit Process Model Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 322743 CVE-2026-112639: Luke Francis (@lukefr09) WebRTC Available for: Apple Vision Pro (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 323096 CVE-2026-113901: Kwak Kiyong (@Pwnkai23), Song Nuri Wi-Fi Available for: Apple Vision Pro (all models) Impact: An attacker in physical proximity may be able to corrupt process memory Description: A memory corruption issue was addressed with improved input validation. CVE-2026-113909: an anonymous researcher Wi-Fi Available for: Apple Vision Pro (all models) Impact: An attacker in a privileged network position may be able to cause a denial-of-service Description: A denial-of-service issue was addressed with improved input validation. CVE-2026-112620: Nathaniel Oh (@calysteon) Additional recognition Apple Neural Engine We would like to acknowledge Vladislav Shevchenko (Positive Technologies) for their assistance. AVEVideoEncoder We would like to acknowledge Josh Maine of Calif.io, Narendra Singh (@_3P1C) for their assistance. CoreAudio We would like to acknowledge Meta Product Security for their assistance. CoreCrypto We would like to acknowledge Niels Hofmans for their assistance. Foundation We would like to acknowledge Jaya Surya Kommireddy for their assistance. Kernel We would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Tristan Madani (@TristanInSec) from Talence Security for their assistance. libarchive We would like to acknowledge Muhammad Abdul Rehman, Owais Lone for their assistance. Mail We would like to acknowledge Dominik Conrads of Federal Office for Information Security for their assistance. mDNSResponder We would like to acknowledge Aswin Kumar Gokula Kannan, Lucas Lammer, pixillated for their assistance. Notes We would like to acknowledge Mikita Sakalouski for their assistance. Safari We would like to acknowledge Azza Tegar Naufal Ataullah, Exell Nakano, Zhiyang Zeng (@Wester), satrya wira yudha for their assistance. Sandbox Profiles We would like to acknowledge Ilya Andr (andrd3v) of Positive Technologies for their assistance. WebKit We would like to acknowledge Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Wael Alolowi, an anonymous researcher for their assistance. WebKit Sandboxing We would like to acknowledge Claudio Bozzato and Francesco Benvenuto of Cisco Talos for their assistance. Instructions on how to update visionOS are available at https://support.apple.com/kb/HT214009 To check the software version on your Apple Vision Pro, open the Settings app and choose General > About. All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmrfvS0ACgkQ4Ifiq8DH 7PUABQ/9FF817l7+SwwKFcB5tbmWh9U+85iO7lrUOapOyhtZtSXM7Z3Lu6JYwFr9 irVgYqmG+1W1AZSjnCcg5oGr51Y57l1H5lqGHp/4/lJEOOXzIniqSxCe7TFm+dFZ 7I1zudAEv8ahdjUVEbUqz17+gYZT7F8SWGNxQdUy6ePlNosKcmKxou8Fi6hmVIp/ OmXR4u/+yikDz9JCFCyVDK4AJgJxzwcXw9N+q5nsliaPwyffN+YSL9OHprj/4uSD nK6OpNRRBBhy4cpu0ebzeVQuCFN6FJGZ5nceq30emJI0iw1TeHqzDLJWjzXkmGC5 /JA6m7USyhSdhl/1DhramuwYltIu1U8bGr6fe/9EYMpjnF14qzNdJk5fb3zNmSNo rnyuEeieL1fcJj5G//T60vwDRYD9raDsI4utfZ9p3UeWTxTSVwNMS0dlqk+J82fJ I/kMYRLG6tJt5Vir61P2TGgKVajwW7Bg9i/d9RR8Zq6Nd6zJt/Wpvcyu7Ra0bVK7 eqH59xHvHJkcl+UCbIUbjg0OzfuupS+72XYyUjIej+RX8NNFJ5RYQLo2SKV0ZSxG ZfOeFg8eF0LWwGFsKPu0jqh7FPFGtgqpNE0Kr6ytpK2EgfIif9o3d8ehlYY2SXN0 8pLQd35YHZPzmQ2oFMnxM7YQfe8+TXHt8lw+9h6NL6RjP7laILM= =Rl2Y -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/