Apple iOS 27.2 fixes 163 flaws, including critical WebKit RCE
The release addresses memory corruption, sandbox escape, kernel writes, and unauthorized access to sensitive user data across many components.
74
Vulnerability1 · 1 read
CVE-2026-86988
Process memory disclosure via crafted image on Apple OSes
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Processing a maliciously crafted image can disclose process memory. An attacker must get the device to process that image; Apple does not state further authentication requirements. The leak is limited to memory of the process that handles the image. Fixes ship in iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2.
What to do: Update iOS, iPadOS, macOS Golden Gate, tvOS, visionOS, and watchOS to 27.2.
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | — | 27.2 |
| Apple iPadOS | — | 27.2 |
| Apple macOS Golden Gate | — | 27.2 |
| Apple tvOS | — | 27.2 |
| Apple visionOS | — | 27.2 |
| Apple watchOS | — | 27.2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.