Loading vulnerability…
Out-of-bounds access in Apple media processing
CVE-2026-113912 is an out-of-bounds memory access vulnerability in media processing across Apple iOS, iPadOS, macOS, tvOS, and visionOS. Processing a maliciously crafted media file may cause unexpected application termination or corrupt process memory. The specific vulnerable component, function, and media format are not identified. Apple addressed the issue with improved bounds checking.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A maliciously crafted media file can cause an application-level denial of service through unexpected termination or corrupt the memory of the process handling the file. Arbitrary code execution, privilege escalation, and information disclosure are not established.
If you can’t patch tonight, do this now.
No workaround is specified.
Patch, then assume compromise.
Install the applicable fixed release: iOS 26.7 or 27.2; iPadOS 26.7 or 27.2; macOS Golden Gate 27.2; macOS Sequoia 15.8.2; macOS Tahoe 26.7.2; tvOS 27.2; or visionOS 27.2. These releases incorporate improved bounds checking.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.