Apple

iOS 26.7.2 and iPadOS 26.7.2

149227 Oct 26, 2026 Source: Vendor

Imported by the Apple release catcher from https://support.apple.com/en-us/149227. 134 CVE entries, 7 additional recognitions. Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later. Draft. Review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://support.apple.com/en-us/149227

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

254 lines

Showing 151–200 of 254 , page 4 of 6

CVE-2026-112414 BR2026-0000-033751 Mail unclaimed

Processing a maliciously crafted message may lead to a denial-of-service

Credited as Daniel Rodríguez

CVE-2026-112414 BR2026-0000-033752 Mail unclaimed

Processing a maliciously crafted message may lead to a denial-of-service

Credited as Nathaniel Oh (@calysteon)

CVE-2026-112707 BR2026-0000-033753 Maps unclaimed

An app may be able to identify what other apps a user has installed

Credited as Sindre Sorhus

CVE-2026-113915 BR2026-0000-033754 MediaAnalysis unclaimed

An app may be able to access sensitive user data

Credited as Abodi Dawoud

CVE-2026-113915 BR2026-0000-033755 MediaAnalysis unclaimed

An app may be able to access sensitive user data

Credited as Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova

CVE-2026-113915 BR2026-0000-033756 MediaAnalysis unclaimed

An app may be able to access sensitive user data

Credited as Ilya Andr (andrd3v) of Positive Technologies

CVE-2026-113915 BR2026-0000-033757 MediaAnalysis unclaimed

An app may be able to access sensitive user data

Credited as Zhongquan Li (@Guluisacat)

CVE-2026-86880 BR2026-0000-033758 MediaRemote unclaimed

An app may be able to access sensitive user data

Credited as Asaf Cohen

CVE-2026-112682 BR2026-0000-033759 Messages unclaimed

A remote attacker may be able to cause unexpected app termination

Credited as Mahmoud Abdelmoniem

CVE-2026-86989 BR2026-0000-033760 MobileGestalt unclaimed

An app may be able to fingerprint the user

Credited as Ilya Andr (andrd3v) of Positive Technologies

CVE-2026-86989 BR2026-0000-033761 MobileGestalt unclaimed

An app may be able to fingerprint the user

Credited as Zhongcheng Li (CK01)

CVE-2026-112413 BR2026-0000-033762 Model I/O unclaimed

Processing a maliciously crafted file may lead to unexpected app termination

Credited as Nathaniel Oh (@calysteon)

CVE-2026-112461 BR2026-0000-033763 Model I/O unclaimed

Processing a maliciously crafted 3D model may lead to memory corruption

Credited as 진규정 (Gyujeong Jin, @G1uN4sh)

CVE-2026-112461 BR2026-0000-033764 Model I/O unclaimed

Processing a maliciously crafted 3D model may lead to memory corruption

Credited as Lucas Parnell

CVE-2026-112461 BR2026-0000-033765 Model I/O unclaimed

Processing a maliciously crafted 3D model may lead to memory corruption

Credited as Nathaniel Oh (@calysteon)

CVE-2026-112461 BR2026-0000-033766 Model I/O unclaimed

Processing a maliciously crafted 3D model may lead to memory corruption

Credited as Meta Red Team X - Nik Tsytsarkin

CVE-2026-112461 BR2026-0000-033767 Model I/O unclaimed

Processing a maliciously crafted 3D model may lead to memory corruption

Credited as YingMuo (@YingMuo) of DEVCORE Research Team

CVE-2026-112461 BR2026-0000-033768 Model I/O unclaimed

Processing a maliciously crafted 3D model may lead to memory corruption

Credited as ret2happy (@ret2happy)

CVE-2026-112449 BR2026-0000-033769 Model I/O unclaimed

Processing a maliciously crafted 3D model may lead to memory corruption

Credited as ret2happy (@ret2happy)

CVE-2026-112486 BR2026-0000-033770 Model I/O unclaimed

Processing a 3D model may lead to unexpected app termination

Credited as Md Rasel Bhuyan (www.linkedin.com/in/rasel-bhuyan)

CVE-2026-112486 BR2026-0000-033771 Model I/O unclaimed

Processing a 3D model may lead to unexpected app termination

Credited as Musaab Khan (@bxff)

CVE-2026-65397 BR2026-0000-033772 Photos Storage unclaimed

An app may be able to access sensitive user data

Credited as Varik Matevosyan (@D4RK7ET)

CVE-2026-112660 BR2026-0000-033773 Photos Storage unclaimed

An app may be able to bypass certain Privacy preferences

Credited as Prafull Dhiman

CVE-2026-112660 BR2026-0000-033774 Photos Storage unclaimed

An app may be able to bypass certain Privacy preferences

Credited as Alto_00000

CVE-2026-112676 BR2026-0000-033775 Photos Storage unclaimed

An app may be able to access a user's Photos Library

Credited as Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova

CVE-2026-112491 BR2026-0000-033776 RealityKit unclaimed

Processing a maliciously crafted file may lead to unexpected app termination

Credited as Hongsik Kim (mnur)

CVE-2026-112425 BR2026-0000-033777 SceneKit unclaimed

Processing a 3D model may result in disclosure of process memory

Credited as stratan (@5tratan)

CVE-2026-112423 BR2026-0000-033778 SceneKit unclaimed

Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents

Credited as Rahul Raj

CVE-2026-112464 BR2026-0000-033779 SceneKit unclaimed

Processing a maliciously crafted file may lead to heap corruption

Credited as 정우 하 (@0xfa11babe)

CVE-2026-112464 BR2026-0000-033780 SceneKit unclaimed

Processing a maliciously crafted file may lead to heap corruption

Credited as Narendra Singh (@_3P1C)

CVE-2026-86991 BR2026-0000-033781 SceneKit unclaimed

Processing a maliciously crafted file may lead to unexpected process termination

Credited as Cem Onat Karagun

CVE-2026-86991 BR2026-0000-033782 SceneKit unclaimed

Processing a maliciously crafted file may lead to unexpected process termination

Credited as Yujung Choi (@Dusker)

CVE-2026-86991 BR2026-0000-033783 SceneKit unclaimed

Processing a maliciously crafted file may lead to unexpected process termination

Credited as Mathis Mansière

CVE-2026-86991 BR2026-0000-033784 SceneKit unclaimed

Processing a maliciously crafted file may lead to unexpected process termination

Credited as Rahul Raj

CVE-2026-113913 BR2026-0000-033785 Security unclaimed

Processing web content may disclose sensitive information

Credited as Niels Hofmans

CVE-2026-113913 BR2026-0000-033786 Security unclaimed

Processing web content may disclose sensitive information

Credited as Stav Nir

CVE-2026-113913 BR2026-0000-033787 Security unclaimed

Processing web content may disclose sensitive information

Credited as Vladimir Tokarev

CVE-2026-65363 BR2026-0000-033788 Security unclaimed

An app may be able to break out of its sandbox

Credited as Arni Hardarson (Neonix Security)

CVE-2026-65363 BR2026-0000-033789 Security unclaimed

An app may be able to break out of its sandbox

Credited as Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman (@gergely_kalman)

CVE-2026-28864 BR2026-0000-033790 Security unclaimed

A local attacker may gain access to user's Keychain items

Credited as Alex Radocea

CVE-2026-112652 BR2026-0000-033791 Security unclaimed

An malicious app may be able to bypass certificate validation

Credited as Aditya Kumar

CVE-2026-112559 BR2026-0000-033792 Shortcuts unclaimed

An app may be able to access sensitive user data

Credited as Lucas Lammer

CVE-2026-112559 BR2026-0000-033793 Shortcuts unclaimed

An app may be able to access sensitive user data

Credited as Stuart Wallace

CVE-2026-112455 BR2026-0000-033794 Shortcuts unclaimed

An app may be able to access sensitive user data

Credited as Rahul Raj

CVE-2026-112455 BR2026-0000-033795 Shortcuts unclaimed

An app may be able to access sensitive user data

Credited as Chris Bailey - Short Circuit

CVE-2026-84614 BR2026-0000-033796 Siri unclaimed

An attacker with physical access may be able to access contacts from the lock screen

Credited as Jagannath Mohanty

CVE-2026-112628 BR2026-0000-033797 Spotlight unclaimed

An app may be able to access sensitive user data

Credited as Santiago Albertengo

CVE-2026-112628 BR2026-0000-033798 Spotlight unclaimed

An app may be able to access sensitive user data

Credited as Chris Bailey - Short Circuit

CVE-2026-112646 BR2026-0000-033799 SpringBoard unclaimed

An app may be able to cause unexpected system termination or corrupt process memory

Credited as Meta Red Team X - Nik Tsytsarkin

CVE-2026-112691 BR2026-0000-033800 SwiftUI unclaimed

An app may be able to cause unexpected system termination

Credited as @Licht_jb