CVE-2026-112689: Kernel memory corruption in Apple systems

Out-of-bounds write in Apple decoder: CVSS 8.4. Affects iOS, macOS, tvOS. Patches available.

CVE-2026-112689 is an out-of-bounds write issue found in Apple's H.264 hardware decoder. The flaw allows an app to cause unexpected system termination or corrupt kernel memory. It affects iOS, iPadOS, macOS and tvOS, potentially impacting billions of devices in enterprise and consumer environments.

CVSS 8.4 in the HIGH range. Apple released fixes on 2026-10-26 for iOS 27.2, iPadOS 27.2, macOS Sequoia 15.8.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, tvOS 27.2 and specific earlier versions (iOS 26.7.2, iPadOS 26.7.2). GitHub reported on 2026-11-03 the availability of a crash reproducer, confirming the vulnerability's reproducibility and indicating broader knowledge dissemination within the technical community.

Defenders must update all affected Apple devices to the correct versions with maximum priority. Prioritize iOS 27.x, macOS 27.x, tvOS 27.x and older devices to the indicated fix versions. Review your inventory, plan the update rollout according to your security policy and confirm patch deployment within your patch management SLA timelines.

At a glance

What: Out-of-bounds write in Apple's H.264 hardware decoder; an app can cause unexpected system termination or corrupt kernel memory.
Severity: CVSS 8.4 (HIGH) – critical impact on system integrity and availability.
Affected versions: iOS <27.2, iPadOS <27.2, macOS Sequoia <15.8.2, macOS Golden Gate <27.2, macOS Tahoe <26.7.2, tvOS <27.2; also iOS <26.7.2 and iPadOS <26.7.2.
Fix: Update to iOS 27.2, iPadOS 27.2, macOS Sequoia 15.8.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, tvOS 27.2 or specific corrected versions (iOS 26.7.2, iPadOS 26.7.2).
Status: Patches released by Apple on 2026-10-26. Crash reproducer available on GitHub as of 2026-11-03, confirming the vulnerability.
Action: Inventory corporate Apple devices; prioritize updating iOS 27.x, macOS 27.x, tvOS 27.x and older devices to the indicated fix versions; verify patch deployment.

Sources: NVD, CVE-2026-112689

← All articles