Apple iOS 27.2 fixes 163 flaws, including critical WebKit RCE
The release addresses memory corruption, sandbox escape, kernel writes, and unauthorized access to sensitive user data across many components.
74
Vulnerability1 · 1 read
CVE-2026-112619
Out-of-bounds write via crafted calendar invitation on Apple OS
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An out-of-bounds write in Apple's handling of calendar invitations can corrupt memory. A person who processes a maliciously crafted invitation can trigger it; the advisory does not say whether that requires opening the invite or further interaction. Apple fixed it in iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2, and watchOS 27.2. Earlier builds of those systems are not listed.
What to do: Update to iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2, or watchOS 27.2. Apple has not named a workaround.
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | — | iOS 27.2 |
| Apple iPadOS | — | iPadOS 27.2 |
| Apple macOS | — | macOS Golden Gate 27.2 |
| Apple visionOS | — | visionOS 27.2 |
| Apple watchOS | — | watchOS 27.2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted calendar invitation may lead to memory corruption.