Cve-2026-112705 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-112705/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 09:39:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApple AVEVideoEncoder: Out-of-bounds write (CVE-2026-112705)https://feed.craftedsignal.io/briefs/2026-10-avevideoencoder-oob-write/Fri, 30 Oct 2026 09:39:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-avevideoencoder-oob-write/An out-of-bounds write vulnerability in Apple's AVEVideoEncoder component allows for kernel-level denials of service through specifically crafted high-resolution H.264 compression sessions.CVE-2026-112705 is an out-of-bounds write vulnerability within the AVEVideoEncoder component, which handles hardware-accelerated video compression on Apple devices. The vulnerability is triggered by specific H.264 VTCompressionSession configurations, specifically when using a 32768 x 16384 resolution with a BGRA pixel buffer. This action causes a kernel panic and subsequent device reboot. Apple has confirmed the issue and provided a fix via improved bounds checking in updated versions.

Impact

The vulnerability results in an immediate denial-of-service condition, manifested as a kernel panic and device reboot. While the current public proof-of-concept is limited to a crash-only reproducer, out-of-bounds write vulnerabilities in kernel-mode components pose risks for memory corruption and potential privilege escalation in more sophisticated attack chains.

Recommendation

  • Update all affected Apple devices to the latest available software version to apply the security fix provided by Apple.
  • Implement internal device management policies to enforce timely updates, particularly for mobile hardware (iPhone, iPad).
  • Use mobile device management (MDM) telemetry to identify devices running outdated iOS versions.
]]>highadvisoryapplekernelvulnerabilitydenial-of-servicecve-2026-112705