CVE-2026-112449
Low risk· EPSS 12%Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An integer overflow was addressed with improved input validation. The issue affects iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.
Risk Assessment
Opening a malicious 3D model may cause memory corruption, potentially leading to a crash or arbitrary code execution.
Recommendation
Update iOS, iPadOS, macOS, and visionOS to fixed versions.
Other vulnerabilities in iOS, iPadOS, macOS, visionOS
See all- CVE-2026-112500Medium
A logic issue was addressed with improved restrictions. The issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, and visionOS 27.2, and the user's original email address may be leaked when using the Hide My Email feature.
- CVE-2026-64752High
A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing a maliciously crafted image may lead to arbitrary code execution.
- CVE-2026-43689High
A permissions issue in Apple systems was addressed with additional restrictions. The issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, and visionOS 27. A malicious app may be able to gain root privileges.
- CVE-2025-43389Medium
A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, visionOS 26.1. An app may be able to access sensitive user data.
Original NVD description (English source)
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS