Apple

iOS 26.7.2 and iPadOS 26.7.2

149227 Oct 26, 2026 Source: Vendor

Imported by the Apple release catcher from https://support.apple.com/en-us/149227. 134 CVE entries, 7 additional recognitions. Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later. Draft. Review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://support.apple.com/en-us/149227

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

254 lines

Showing 51–100 of 254 , page 2 of 6

CVE-2026-112611 BR2026-0000-033651 CoreGraphics unclaimed

Processing a maliciously crafted PDF file may lead to memory corruption

Credited as Aobo Wang (@M4x_1997)

CVE-2026-112611 BR2026-0000-033652 CoreGraphics unclaimed

Processing a maliciously crafted PDF file may lead to memory corruption

Credited as Xiang Chen

CVE-2026-112611 BR2026-0000-033653 CoreGraphics unclaimed

Processing a maliciously crafted PDF file may lead to memory corruption

Credited as Jakob Pammer

CVE-2026-112611 BR2026-0000-033654 CoreGraphics unclaimed

Processing a maliciously crafted PDF file may lead to memory corruption

Credited as Anna Groza (@pwnlambda) of Calif.io

CVE-2026-112611 BR2026-0000-033655 CoreGraphics unclaimed

Processing a maliciously crafted PDF file may lead to memory corruption

Credited as Piotr Jerzy Duszynski

CVE-2026-86992 BR2026-0000-033656 CoreMedia unclaimed

Processing a maliciously crafted video file may lead to unexpected app termination

Credited as Niels Hofmans

CVE-2026-112706 BR2026-0000-033657 CoreMedia unclaimed

An app may be able to access sensitive user data

Credited as Adriatik Raci

CVE-2026-112706 BR2026-0000-033658 CoreMedia unclaimed

An app may be able to access sensitive user data

Credited as Chris Bailey - Short Circuit

CVE-2026-112706 BR2026-0000-033659 CoreMedia unclaimed

An app may be able to access sensitive user data

Credited as Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova

CVE-2026-86990 BR2026-0000-033660 CoreMedia unclaimed

A malicious app may be able to access the camera without user permission

Credited as Mustafa Calap (@ordinal0, dbg.re)

CVE-2026-112656 BR2026-0000-033661 CoreText unclaimed

Processing a maliciously crafted font may result in the disclosure of process memory

Credited as Nurihan Kim (HanTul) working with TrendAI Zero Day Initiative

CVE-2026-113896 BR2026-0000-033662 FileProvider unclaimed

An app may be able to access sensitive user data

Credited as Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova

CVE-2026-113896 BR2026-0000-033663 FileProvider unclaimed

An app may be able to access sensitive user data

Credited as R4mbb

CVE-2026-86970 BR2026-0000-033664 FontParser unclaimed

Processing a maliciously crafted font may result in the disclosure of process memory

Credited as Hcamael

CVE-2026-86970 BR2026-0000-033665 FontParser unclaimed

Processing a maliciously crafted font may result in the disclosure of process memory

Credited as 章鱼哥@aipy (aipyaipy.com)

CVE-2026-112683 BR2026-0000-033666 FontParser unclaimed

Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory

Credited as Hcamael

CVE-2026-112683 BR2026-0000-033667 FontParser unclaimed

Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory

Credited as 章鱼哥@aipy (aipyaipy.com)

CVE-2026-112642 BR2026-0000-033668 FontParser unclaimed

Processing a maliciously crafted font may result in the disclosure of process memory

Credited as Meta Red Team X - Nik Tsytsarkin

CVE-2026-86942 BR2026-0000-033669 Heimdal unclaimed

An app may be able to cause a denial-of-service

Credited as He Wei (ギカク)

CVE-2026-112456 BR2026-0000-033670 HFS unclaimed

Processing a maliciously crafted file may lead to heap corruption

Credited as Jihwan Yoon

CVE-2026-112456 BR2026-0000-033671 HFS unclaimed

Processing a maliciously crafted file may lead to heap corruption

Credited as Yash Pandya

CVE-2026-112456 BR2026-0000-033672 HFS unclaimed

Processing a maliciously crafted file may lead to heap corruption

Credited as Parth Raval

CVE-2026-84627 BR2026-0000-033673 ImageIO unclaimed

Processing a maliciously crafted image may lead to heap corruption

Credited as ธนกฤต ทัฬหะ

CVE-2026-84627 BR2026-0000-033674 ImageIO unclaimed

Processing a maliciously crafted image may lead to heap corruption

Credited as Mateusz Jurczyk of Google Project Zero

CVE-2026-84627 BR2026-0000-033675 ImageIO unclaimed

Processing a maliciously crafted image may lead to heap corruption

Credited as f0r of MurphySec

CVE-2026-84627 BR2026-0000-033676 ImageIO unclaimed

Processing a maliciously crafted image may lead to heap corruption

Credited as PETOWORKS의 Bugeun Choi (@Bugeun)

CVE-2026-84627 BR2026-0000-033677 ImageIO unclaimed

Processing a maliciously crafted image may lead to heap corruption

Credited as Piotr Jerzy Duszynski

CVE-2026-84627 BR2026-0000-033678 ImageIO unclaimed

Processing a maliciously crafted image may lead to heap corruption

Credited as Rahul Raj

CVE-2026-112488 BR2026-0000-033679 ImageIO unclaimed

Processing a maliciously crafted image may corrupt process memory

Credited as Mateusz Jurczyk of Google Project Zero

CVE-2026-112488 BR2026-0000-033680 ImageIO unclaimed

Processing a maliciously crafted image may corrupt process memory

Credited as Nik Tsytsarkin

CVE-2026-64750 BR2026-0000-033681 ImageIO unclaimed

Processing a maliciously crafted image may result in memory corruption

Credited as Mateusz Jurczyk of Google Project Zero

CVE-2026-64750 BR2026-0000-033682 ImageIO unclaimed

Processing a maliciously crafted image may result in memory corruption

Credited as Eddy Tsalolikhin

CVE-2026-64750 BR2026-0000-033683 ImageIO unclaimed

Processing a maliciously crafted image may result in memory corruption

Credited as Johann Rehberger

CVE-2026-112571 BR2026-0000-033684 ImageIO unclaimed

Processing a maliciously crafted image may result in disclosure of process memory

Credited as sh3rlock (김보겸)

CVE-2026-112560 BR2026-0000-033685 ImageIO unclaimed

Processing a maliciously crafted image may result in disclosure of process memory

Credited as Wout van der Ploeg (woutvanderploeg.nl)

CVE-2026-112561 BR2026-0000-033686 ImageIO unclaimed

Processing a maliciously crafted image may result in disclosure of process memory

Credited as Meta Red Team X - Nik Tsytsarkin

CVE-2026-112627 BR2026-0000-033687 ImageIO unclaimed

Processing a maliciously crafted image may result in disclosure of process memory

Credited as Mateusz Jurczyk of Google Project Zero

CVE-2026-64759 BR2026-0000-033688 ImageIO unclaimed