{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/coregraphics/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apple:ios:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-112610"},{"id":"CVE-2026-112611"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["iOS (\u003c= 27.0)"],"_cs_severities":["high"],"_cs_tags":["apple","ios","coregraphics","vulnerability","oob-write"],"_cs_type":"advisory","_cs_vendors":["Apple"],"content_html":"\u003cp\u003eTwo out-of-bounds write vulnerabilities in the CoreGraphics PDF rendering stack were identified through function-level differential analysis of iOS 27.0 and 27.2 binaries. The vulnerabilities involve improper bounds checking during the processing of Type 5 (lattice-form Gouraud) shading (CVE-2026-112611) and CMap recursion (CVE-2026-112610). These flaws allow an attacker to write attacker-chosen values to out-of-bounds memory locations when a target application renders a maliciously crafted PDF. Apple addressed these issues in iOS 27.2.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerabilities allow for the writing of arbitrary IEEE-754 double values to memory. While the published research and accompanying artifacts are restricted to crash-only oracles, the ability to perform out-of-bounds writes carries the potential for arbitrary code execution if chained with other primitives.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all iOS devices to iOS 27.2 (24B115) or later to mitigate the underlying vulnerabilities addressed in security advisory HT149230.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized or suspicious crash reports related to CoreGraphics or QuickLook processes using the provided crash-analysis methodology.\u003c/li\u003e\n\u003cli\u003eImplement strict document handling policies for mobile devices, specifically limiting the automatic previewing or rendering of untrusted PDF files.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T12:49:06Z","date_published":"2026-10-27T12:49:06Z","id":"https://feed.craftedsignal.io/briefs/2026-10-coregraphics-oob-write/","summary":"Researchers have published analysis and crash-inducing proof-of-concept generators for two out-of-bounds write vulnerabilities in the Apple CoreGraphics PDF stack, both patched in iOS 27.2.","title":"Apple iOS: CoreGraphics PDF stack out-of-bounds write vulnerabilities (CVE-2026-112611, CVE-2026-112610)","url":"https://feed.craftedsignal.io/briefs/2026-10-coregraphics-oob-write/"}],"language":"en","title":"CraftedSignal Threat Feed - Coregraphics","version":"https://jsonfeed.org/version/1.1"}