AI description
CVE-2026-112688 is a memory corruption vulnerability identified in Apple's CoreMedia framework. Discovered by security researchers Jungwoo Ha (@0xfa11babe) and Chris Bailey of Short Circuit, the issue occurs during the parsing of media files. When a system processes a specifically crafted file, the vulnerability can trigger unexpected application termination or allow for arbitrary code execution. Apple resolved the vulnerability by implementing improved memory handling in its software updates. The patches are available in several operating system versions, including iOS and iPadOS 26.7.2, iOS and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.
- Description
- A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Parsing a file may lead to an unexpected app termination or arbitrary code execution.
- Source
- product-security@apple.com
- NVD status
- Awaiting Analysis
CVSS 3.1
- Type
- Secondary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity
- HIGH
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- CWE-119
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
13