Apple iOS 27.2 fixes 163 flaws, including critical WebKit RCE
The release addresses memory corruption, sandbox escape, kernel writes, and unauthorized access to sensitive user data across many components.
74
CVE-2026-112701
App authorization flaw exposing sensitive data on iOS and iPadOS
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An authorization flaw in iOS and iPadOS, tied to state management, may let an app access sensitive user data. A locally installed app can trigger it; network access and user interaction are not described. Apple fixed it in iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, and iPadOS 27.2. Devices still on earlier releases remain affected.
What to do: Update to iOS 26.7.2 or 27.2, or iPadOS 26.7.2 or 27.2, which include the state-management fix.
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | — | 26.7.2 and 27.2 |
| Apple iPadOS | — | 26.7.2 and 27.2 |
Estimated exposure
largeNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.
- Weakness
- CWE-862
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N