Apple iOS 27.2 fixes 163 flaws, including critical WebKit RCE
Original title: Apple iOS 27.2 Released With Fixes for 163 Vulnerabilities, Including Fix for Critical WebKit RCE
The release addresses memory corruption, sandbox escape, kernel writes, and unauthorized access to sensitive user data across many components.
Apple released iOS 27.2 with fixes for 163 vulnerabilities, including a critical WebKit remote-code-execution issue. The published notes cover flaws in components including WebContent, Apple Neural Engine, CoreAudio, CoreGraphics, Accounts, and Bluetooth. Impacts include unexpected termination, kernel or process memory corruption, sandbox escape, and access to sensitive user data. The notes describe the fixes but do not say whether any flaw is being exploited.
Unconfirmed: The excerpt does not state whether any of the 163 flaws is exploited in the wild.
- A remote attacker may break out of the WebContent sandbox (CVE-2026-112690).
- Neural Engine flaws can terminate the system or corrupt or write kernel memory.
- Physical access to a trust-paired device may allow arbitrary file read and write.
- Nearby Bluetooth attackers may cause denial of service through null-pointer bugs.
- Crafted images, video, audio, PDFs, fonts, or calendar invites can corrupt memory.
Impact: WebKit remote code execution and memory corruption or data access
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | — | 27.2 |
- 1.Install iOS 27.2 to receive the listed security fixes.
- CVEs
- CVE-2026-86971CVE-2026-84493CVE-2026-113898CVE-2026-112446CVE-2026-112612CVE-2026-112692CVE-2026-113914CVE-2026-112690CVE-2026-86987CVE-2026-112696CVE-2026-84494CVE-2026-112416CVE-2026-112415CVE-2026-112454CVE-2026-112546CVE-2026-112705CVE-2026-112689CVE-2026-112470CVE-2026-112469CVE-2026-112468CVE-2026-112466CVE-2026-112566CVE-2026-113906CVE-2026-112678CVE-2026-112619CVE-2026-112701CVE-2026-86988CVE-2026-113910CVE-2026-113908CVE-2026-113912
- Vendors
- Apple
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-113912 | Out-of-bounds access via crafted media on Apple OS | 7.1 group max | — | ||
CVE-2026-112416+1 related CVE | Out-of-bounds write when processing video on Apple OSes | — | — | ||
| CVE-2026-86987 | Authorization flaw in iOS and iPadOS before 27.2 | 5.5 | — |
From the original article
12 min read at cybersecuritynews.com
Apple released iOS 27. 2 and iPadOS 27. 2 on October 26, 2026, with fixes for 163 security flaws.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.