Out-of-bounds write in macOS - CVE-2026-112461
Published: October 27, 2026
Vulnerability identifier: #VU157905
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-112461
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to corrupt memory, potentially causing a denial of service or arbitrary code execution.
The vulnerability exists due to an out-of-bounds write in Model I/O when processing input. A remote attacker can supply crafted input to potentially write outside the bounds of an allocated memory region and cause memory corruption.
Affected software
macOS
Apple iOS
iPadOS
Apple iOS
iPadOS
How to mitigate CVE-2026-112461
Install update from vendor's website.
macOS - addressed in versions 27.2 26B123, 15.8.2 24H232, 26.7.2 25G332
Apple iOS - addressed in versions 26.7.2, 27.2 24B119, 27.2 24B120, 27.2 24B91020
iPadOS - addressed in versions 26.7.2, 27.2 24B119
Apple iOS - addressed in versions 26.7.2, 27.2 24B119, 27.2 24B120, 27.2 24B91020
iPadOS - addressed in versions 26.7.2, 27.2 24B119