CVE-2026-112571
Low risk· EPSS 15%Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A memory initialization vulnerability in Apple operating systems was addressed with improved memory handling. Processing a maliciously crafted image may result in disclosure of process memory.
Risk Assessment
An attacker could deliver a malicious image that discloses sensitive process memory, compromising confidentiality. This could lead to information leakage.
Recommendation
Update iOS, iPadOS, macOS, tvOS, visionOS, and watchOS to version 27.2 or macOS Sequoia 15.8.2 and Tahoe 26.7.2, which include the fix.
Other vulnerabilities in Apple operating systems
See all- CVE-2023-40403Medium
The issue was addressed with improved memory handling. It is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information.
- CVE-2026-64774Critical
An integer overflow vulnerability was addressed with improved input validation. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64772Critical
An out-of-bounds write issue was addressed with improved input validation. Affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64771Critical
A buffer overflow vulnerability was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64770Critical
An out-of-bounds write issue was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64769Critical
An out-of-bounds write issue was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64746Critical
An authorization issue was addressed with improved validation. Affects iOS, iPadOS, macOS, visionOS, and watchOS. An app may add contacts without user authorization.
- CVE-2026-64726Critical
The issue was addressed with improved memory handling. Affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An attacker in physical proximity may corrupt process memory.
- CVE-2026-43812Critical
A use after free issue was addressed with improved memory management. Affects iOS, iPadOS, macOS, tvOS, and visionOS. An app may cause unexpected system termination.
- CVE-2026-43809Critical
An out-of-bounds read was addressed with improved bounds checking. Affects iOS, iPadOS, macOS. An app may cause unexpected system termination.
Original NVD description (English source)
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS