CVE-2026-112705: out-of-bounds write in Apple systems

CVE-2026-112705 is an out-of-bounds write flaw affecting iOS, iPadOS, macOS and tvOS. According to the official description, a malicious app may cause unexpected system termination. A public reproducer in GitHub repositories identifies AVEVideoEncoder as the affected component. The simplicity of exploitation for denial-of-service via crash makes this vulnerability concretely dangerous in production environments running untrusted applications.

Out-of-bounds write is classified as a serious memory defect because it permits writing data to unallocated or non-owned memory regions. Apple released the fix on October 26, 2026. A public reproducer became available on October 30, 2026 in GitHub repositories, confirming reproducibility and convergent community signals on this vulnerability. The CVSS score has not been officially published; the defect nature suggests a high or critical rating.

For defenders and administrators: prioritize updating all instances to iOS 26.7.2 or 27.2, iPadOS 26.7.2 or 27.2, macOS Sequoia 15.8.2, Tahoe 26.7.2, Golden Gate 27.2, tvOS 27.2. Validate updates in controlled test environments before production rollout, verifying compatibility with mission-critical applications. Monitor system logs for signs of abnormal termination in the days before patching, in case exploitation is already underway.

Given the availability of public reproducer and zero transport time from disclosure to proof-of-concept, accelerate patching timeline beyond your standard schedule. Do not download exploits from public repositories: implement official patches and perform security verification.