{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aappleavevideoencoder/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apple:avevideoencoder:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-112705"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AVEVideoEncoder"],"_cs_severities":["high"],"_cs_tags":["apple","kernel","vulnerability","denial-of-service","cve-2026-112705"],"_cs_type":"advisory","_cs_vendors":["Apple"],"content_html":"\u003cp\u003eCVE-2026-112705 is an out-of-bounds write vulnerability within the AVEVideoEncoder component, which handles hardware-accelerated video compression on Apple devices. The vulnerability is triggered by specific H.264 \u003ccode\u003eVTCompressionSession\u003c/code\u003e configurations, specifically when using a 32768 x 16384 resolution with a BGRA pixel buffer. This action causes a kernel panic and subsequent device reboot. Apple has confirmed the issue and provided a fix via improved bounds checking in updated versions.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in an immediate denial-of-service condition, manifested as a kernel panic and device reboot. While the current public proof-of-concept is limited to a crash-only reproducer, out-of-bounds write vulnerabilities in kernel-mode components pose risks for memory corruption and potential privilege escalation in more sophisticated attack chains.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all affected Apple devices to the latest available software version to apply the security fix provided by Apple.\u003c/li\u003e\n\u003cli\u003eImplement internal device management policies to enforce timely updates, particularly for mobile hardware (iPhone, iPad).\u003c/li\u003e\n\u003cli\u003eUse mobile device management (MDM) telemetry to identify devices running outdated iOS versions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T09:39:42Z","date_published":"2026-10-30T09:39:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-avevideoencoder-oob-write/","summary":"An out-of-bounds write vulnerability in Apple's AVEVideoEncoder component allows for kernel-level denials of service through specifically crafted high-resolution H.264 compression sessions.","title":"Apple AVEVideoEncoder: Out-of-bounds write (CVE-2026-112705)","url":"https://feed.craftedsignal.io/briefs/2026-10-avevideoencoder-oob-write/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:apple:avevideoencoder:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}