Apple iOS, iPadOS and macOS: Memory corruption in CoreMedia file parsing
Summary
A memory corruption flaw in the CoreMedia media framework of Apple iOS, iPadOS and macOS can be triggered by parsing a crafted file. Successful exploitation can cause an unexpected app termination or arbitrary code execution. No authentication is needed, but a user must open or process the malicious file. No in-the-wild exploitation is known.
Affected
- iOS and iPadOS below 26.7 and below 27.2 (CNA data)
- macOS below 15.8.2, below 26.7.2 and below 27.2 (CNA data)
Fixed in
- iOS 26.7 and iPadOS 26.7
- iOS 27.2 and iPadOS 27.2
- macOS Golden Gate 27.2
- macOS Sequoia 15.8.2
- macOS Tahoe 26.7.2
Workaround
Unknown. Apple documents no workaround; installing the fixed versions is the remedy.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- Not listed in KEV according to a secondary tracker (CISA not checked directly)
- No public proof of concept found
- Apple does not report known active exploitation
Our recommendation
- Update all iPhone, iPad and Mac devices to the fixed versions, enforce updates via MDM where available
- Check the inventory for devices below the fixed versions
- Be cautious with media files and attachments from unknown senders until patched
- Monitor vendor advisories for changes in exploitation status
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apple Security Content of macOS Golden Gate 27.2 support.apple.com
- Apple Security Content of macOS Tahoe 26.7.2 support.apple.com
- Apple Security Content of iOS 27.2 and iPadOS 27.2 support.apple.com
- Apple Security Content of iOS 26.7 and iPadOS 26.7 support.apple.com
- Apple Security Content of macOS Sequoia 15.8.2 support.apple.com
- CVE-2026-112688 on CVEmon cvemon.intruder.io
- CVE-2026-112688 on Strix www.strix.ai
- SecurityWeek: iOS and macOS 27.2 patch 286 bugs www.securityweek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:25.
Original description (NVD)
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Parsing a file may lead to an unexpected app termination or arbitrary code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.