Apple October 2026 updates patch 304 flaws, including prior exploit
Already exploited CoreGraphics flaw CVE-2026-86950 now gets iOS 18 fixes; no newly exploited bug is flagged.
76
Vulnerability1 · 1 read
CVE-2026-112449
Integer overflow in Apple 3D model processing
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An integer overflow in Apple’s handling of 3D models can corrupt memory when a crafted model is processed. A remote attacker needs the user to open or otherwise process that file; no other authentication detail is given. Successful processing may corrupt memory on affected iPhone, iPad, Mac, and Vision devices. Apple lists fixes in the OS releases below and has not listed affected builds.
What to do: Update to iOS/iPadOS 26.7.2 or 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, macOS Golden Gate 27.2, or visionOS 27.2. No workaround is stated.
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | — | 26.7.2 and 27.2 |
| Apple iPadOS | — | 26.7.2 and 27.2 |
| Apple macOS Golden Gate | — | 27.2 |
| Apple macOS Sequoia | — | 15.8.2 |
| Apple macOS Tahoe | — | 26.7.2 |
| Apple visionOS | — | 27.2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.