Apple AVEVideoEncoder: Out-of-bounds write (CVE-2026-112705)

CVE-2026-112705 is an out-of-bounds write vulnerability within the AVEVideoEncoder component, which handles hardware-accelerated video compression on Apple devices. The vulnerability is triggered by specific H.264 VTCompressionSession configurations, specifically when using a 32768 x 16384 resolution with a BGRA pixel buffer. This action causes a kernel panic and subsequent device reboot. Apple has confirmed the issue and provided a fix via improved bounds checking in updated versions.

Impact

The vulnerability results in an immediate denial-of-service condition, manifested as a kernel panic and device reboot. While the current public proof-of-concept is limited to a crash-only reproducer, out-of-bounds write vulnerabilities in kernel-mode components pose risks for memory corruption and potential privilege escalation in more sophisticated attack chains.

Recommendation

• Update all affected Apple devices to the latest available software version to apply the security fix provided by Apple.
• Implement internal device management policies to enforce timely updates, particularly for mobile hardware (iPhone, iPad).
• Use mobile device management (MDM) telemetry to identify devices running outdated iOS versions.