CVE-2026-112621
Low risk· EPSS 14%Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
An out-of-bounds write issue was addressed with improved bounds checking. Processing a maliciously crafted image may result in memory corruption.
Risk Assessment
An attacker could exploit a malicious image to corrupt memory, potentially leading to a crash or code execution. This affects Safari and Apple devices running iOS, iPadOS, macOS, and visionOS.
Recommendation
Update systems to the fixed versions: Safari 27.2, iOS/iPadOS 26.7.2 or 27.2, macOS Golden Gate 27.2, visionOS 27.2.
Other vulnerabilities in Apple Safari/iOS/iPadOS/macOS/visionOS
See all- CVE-2026-86986Low risk· EPSS 8%
A use-after-free issue was addressed with improved memory management in Safari and Apple platforms (iOS, iPadOS, macOS, visionOS). Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2026-86974Low risk· EPSS 9%
A type confusion issue was addressed with improved checks. Processing maliciously crafted web content may lead to memory corruption. The issue affects Safari 27.2, iOS/iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, and visionOS 27.2.
- CVE-2026-112695Low risk· EPSS 9%
A use-after-free issue was addressed with improved memory management. The issue affects Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, and visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.
- CVE-2026-112693Low risk· EPSS 8%
A use-after-free issue was addressed with improved memory management. The issue affects Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, and visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2026-112659High
A type confusion issue was addressed with improved memory handling. The vulnerability affects Safari, iOS, iPadOS, macOS, and visionOS. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2026-112654Low risk· EPSS 8%
A use-after-free issue in web content processing was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process termination.
- CVE-2026-112653Low risk· EPSS 9%
A use-after-free issue in web content processing was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process termination.
- CVE-2026-112651High
A use-after-free issue was addressed with improved memory management. The vulnerability affects Safari, iOS, iPadOS, macOS, and visionOS. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2026-112639High
A use-after-free issue in web content processing was addressed with improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2026-112623High
A use-after-free issue was addressed with improved memory management. The vulnerability affects Safari, iOS, iPadOS, macOS, and visionOS. Processing maliciously crafted web content may lead to arbitrary code execution.
Original NVD description (English source)
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing a maliciously crafted image may result in memory corruption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS