{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ios--27.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apple:ios:*:*:*:*:*:*:*:*","cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","cpe:2.3:o:apple:iphone_os:26.5:*:*:*:*:*:*:*","cpe:2.3:o:apple:iphone_os:27.0:*:*:*:*:*:*:*","cpe:2.3:o:apple:iphone_os:27.0.1:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-112610"},{"id":"CVE-2026-112611"},{"id":"CVE-2026-112427"},{"id":"CVE-2026-112438"},{"id":"CVE-2026-86916"},{"cvss":8.8,"id":"CVE-2026-86950"},{"id":"CVE-2026-112706"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["iOS (\u003c= 27.0)","iOS (\u003c 27.2, 26 \u003c 26.7.2, 18 \u003c 18.7.11)","iPadOS (\u003c 27.2, 26 \u003c 26.7.2, 18 \u003c 18.7.11)","macOS Golden Gate (\u003c 27.2)","macOS Tahoe (\u003c 26.7.2)","macOS Sequoia (\u003c 15.8.2)","tvOS (\u003c 27.2)","watchOS (\u003c 27.2)","visionOS (\u003c 27.2)","Safari (\u003c 27.2)","iOS (\u003c 27.2)","iPadOS (\u003c 27.2)"],"_cs_severities":["critical"],"_cs_tags":["apple","ios","coregraphics","vulnerability","oob-write","rce","privilege-escalation","macos"],"_cs_type":"advisory","_cs_vendors":["Apple"],"content_html":"\u003cp\u003eTwo out-of-bounds write vulnerabilities in the CoreGraphics PDF rendering stack were identified through function-level differential analysis of iOS 27.0 and 27.2 binaries. The vulnerabilities involve improper bounds checking during the processing of Type 5 (lattice-form Gouraud) shading (CVE-2026-112611) and CMap recursion (CVE-2026-112610). These flaws allow an attacker to write attacker-chosen values to out-of-bounds memory locations when a target application renders a maliciously crafted PDF. Apple addressed these issues in iOS 27.2.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerabilities allow for the writing of arbitrary IEEE-754 double values to memory. While the published research and accompanying artifacts are restricted to crash-only oracles, the ability to perform out-of-bounds writes carries the potential for arbitrary code execution if chained with other primitives.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all iOS devices to iOS 27.2 (24B115) or later to mitigate the underlying vulnerabilities addressed in security advisory HT149230.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized or suspicious crash reports related to CoreGraphics or QuickLook processes using the provided crash-analysis methodology.\u003c/li\u003e\n\u003cli\u003eImplement strict document handling policies for mobile devices, specifically limiting the automatic previewing or rendering of untrusted PDF files.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T16:04:36Z","date_published":"2026-10-27T12:49:06Z","id":"https://feed.craftedsignal.io/briefs/2026-10-coregraphics-oob-write/","summary":"Researchers have published analysis and crash-inducing proof-of-concept generators for two out-of-bounds write vulnerabilities in the Apple CoreGraphics PDF stack, both patched in iOS 27.2.","title":"Apple iOS: CoreGraphics PDF stack out-of-bounds write vulnerabilities (CVE-2026-112611, CVE-2026-112610)","url":"https://feed.craftedsignal.io/briefs/2026-10-coregraphics-oob-write/"}],"language":"en","title":"CraftedSignal Threat Feed - IOS (\u003c 27.2)","version":"https://jsonfeed.org/version/1.1"}