CVE-2026-112697
Published Oct 26, 2026
Last updated 5 hours ago
AI description
CVE-2026-112697 is a use-after-free vulnerability in WebKit, the web browser engine utilized by Apple's Safari and various in-app browsers. Discovered by OpenAI Codex Security researchers Amy Burnett and Euntae Jang, the flaw occurs when processing maliciously crafted web content. If triggered, this memory handling error can allow a remote attacker to execute arbitrary code on a target device. Apple addressed the vulnerability by implementing improved memory management in its software updates released on October 26, 2026. The fix is included in Safari 27.2, iOS 27.2 and iPadOS 27.2 (as well as iOS 26.7.2 and iPadOS 26.7.2), macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2. At the time of the patch's release, there were no reports of the vulnerability being actively exploited in real-world attacks.
- Description
- A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.
- Source
- product-security@apple.com
- NVD status
- Awaiting Analysis
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
21