CVE-2026-112479

CVE-2026-112479 is an out-of-bounds read vulnerability affecting the USB component of several Apple operating systems, including iOS, iPadOS, and macOS. The flaw is triggered when a malicious USB device is physically connected to an affected system. This connection can cause improper restriction of memory operations, allowing an attacker to trigger unexpected system termination (denial of service) or read sensitive kernel memory. Apple resolved the issue by implementing improved bounds checking to prevent invalid memory operations. The fix has been deployed across multiple software updates, including iOS 26.7.2 and 27.2, iPadOS 26.7.2 and 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and macOS Golden Gate 27.2. Users are advised to update their devices to these patched versions to mitigate the risk of local exploitation.