Apple iOS 27.2 fixes 163 flaws, including critical WebKit RCE
The release addresses memory corruption, sandbox escape, kernel writes, and unauthorized access to sensitive user data across many components.
74
Vulnerability1 · 1 read
CVE-2026-112612
Arbitrary file read/write on trust-paired Apple iOS and iPadOS
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A path-handling flaw in iOS and iPadOS can let someone with physical access to a trust-paired device read and write arbitrary files. No network access or extra user interaction is described beyond that physical, paired access. Apple fixed it in iOS 26.7.2 and iPadOS 26.7.2, and in iOS 27.2 and iPadOS 27.2. Devices still on earlier builds in those lines are affected.
What to do: Update to iOS 26.7.2 or 27.2, or iPadOS 26.7.2 or 27.2, which include the path-validation fix.
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | — | iOS 26.7.2 and iOS 27.2 |
| Apple iPadOS | — | iPadOS 26.7.2 and iPadOS 27.2 |
Estimated exposure
nicheunknown; physical access to a trust-paired device only — Requires physical access to an already trust-paired iPhone or iPad, not remote reach.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files.