Apple iOS 27.2 fixes 163 flaws, including critical WebKit RCE
The release addresses memory corruption, sandbox escape, kernel writes, and unauthorized access to sensitive user data across many components.
74
CVE-2026-112454
Memory corruption via crafted video in Apple OS before 27.2
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A memory-handling flaw in Apple’s video processing can terminate an app or corrupt process memory when a maliciously crafted video file is processed. Triggering it requires that file to be processed; the advisory does not say whether the attacker must be local or already authenticated. It is fixed in iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2. Apple has not listed affected builds.
What to do: Update to iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, or watchOS 27.2.
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | — | 27.2 |
| Apple iPadOS | — | 27.2 |
| Apple macOS Golden Gate | — | 27.2 |
| Apple tvOS | — | 27.2 |
| Apple visionOS | — | 27.2 |
| Apple watchOS | — | 27.2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The issue was addressed with improved memory handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.