CVE-2026-112507

CVE-2026-112507 is an out-of-bounds write vulnerability affecting the kernel of Apple's iOS and iPadOS operating systems. Discovered by security researcher Tim Michaud of Aginor.ai, the flaw allows a malicious application running on a device to trigger unexpected system termination or write directly to kernel memory. This type of memory corruption can potentially be leveraged by attackers to bypass security boundaries or execute unauthorized actions on the affected device. Apple resolved the issue by implementing improved bounds checking to prevent unauthorized memory writes. The fix was rolled out on October 26, 2026, as part of the security updates in iOS 27.2 and iPadOS 27.2, which are available for iPhone 11 and later, as well as various iPad models. Users are advised to update their devices to the latest versions to mitigate the risk.