Loading vulnerability…
Image Processing Out-of-Bounds Read in Apple Operating Systems
CVE-2026-112561 is an out-of-bounds read vulnerability in image processing affecting multiple Apple operating systems. Processing a maliciously crafted image may read beyond an intended memory boundary and disclose memory belonging to the processing application. Apple addressed the vulnerability with improved bounds checking. The specific affected component and function are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may disclose process memory, potentially exposing sensitive information held by the application processing the image. Code execution, privilege escalation, and kernel memory disclosure are not established for this vulnerability.
Patch, then assume compromise.
Install the applicable fixed release: iOS or iPadOS 26.7.2 or 27.2; macOS Golden Gate 27.2, macOS Sequoia 15.8.2, or macOS Tahoe 26.7.2; tvOS 27.2; visionOS 27.2; or watchOS 27.2. These releases address the out-of-bounds read with improved bounds checking.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.