Apple iOS 27.2 fixes 163 flaws, including critical WebKit RCE
The release addresses memory corruption, sandbox escape, kernel writes, and unauthorized access to sensitive user data across many components.
74
Vulnerability1 · 1 read
CVE-2026-113914
Authorization flaw lets an app read sensitive iOS/iPadOS data
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apple fixed an authorization flaw in iOS and iPadOS by improving state management. A local app can access sensitive user data; no network trigger or user interaction is described. Devices still on releases before the listed fixes are affected.
What to do: Update iOS and iPadOS to 26.7.2 or 27.2, matching the installed release line.
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | — | 26.7.2 and 27.2 |
| Apple iPadOS | — | 26.7.2 and 27.2 |
Estimated exposure
largeNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.
- Weakness
- CWE-862
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N