Apple Security Updates: New iPhone and iPad Vulnerabilities Patched

Apple Patches Twenty-Eight Vulnerabilities Across iOS and iPadOS Devices

Released on October 26, 2026, Apple Support reported that updates address security vulnerabilities impacting devices ranging from the iPhone 11 and later to various iPad Pro, iPad Air, and iPad mini models. The updates target flaws spanning out-of-bounds writes in media processing engines, privilege escalation vectors in logging systems, and authorization bypasses that could allow unauthorized access to sensitive user data.

• Critical fixes target out-of-bounds memory corruption bugs in image and video processing parsers.
• Multiple privilege escalation flaws involving Bluetooth and WebContent sandbox limits were resolved.

Out-of-Bounds Memory Corruptions and Kernel Write Risks

A significant portion of the patched vulnerabilities involves out-of-bounds write and read errors within media parsing pipelines. CVE-2026-86971, reported by an anonymous researcher, allowed maliciously crafted images to trigger unexpected app terminations via an out-of-bounds write. Similar memory handling flaws in video and file processing appeared in CVE-2026-84494, discovered by Meta Red Team X investigator Nik Tsytsarkin, and CVE-2026-112415, credited to Hcamael, the developer known as 章鱼哥@aipy, and Rahul Raj.

Deeper system-level risks emerged in kernel memory management. CVE-2026-86987, found by Richard Hyunho Im at Route Zero Security, and CVE-2026-112696 by Jaeyeong Lee, allowed applications to execute out-of-bounds writes capable of corrupting kernel memory or causing unexpected system termination. Additional kernel-level read vulnerabilities, such as CVE-2026-112470 through CVE-2026-112468 reported by Hcamael and 章鱼哥@aipy, enabled processes to read kernel memory through flawed input validation. Mateusz Jurczyk of Google Project Zero and Meta Red Team X investigator Nik Tsytsarkin jointly identified CVE-2026-86988, a memory initialization defect that permitted kernel memory disclosure.

Authorization Bypasses and Sandbox Escapes in iOS 27.2

Beyond memory corruption bugs, the updates resolve multiple privilege escalation and authorization failures. Meta Red Team X investigator Nik Tsytsarkin identified CVE-2026-84493, an authentication defect in state management that permitted malicious applications to access Bluetooth hardware without explicit user consent. Bhaswanth Chigurupati reported CVE-2026-113898, where a logging issue lacking proper data redaction allowed apps to bypass privacy preferences.

Jaebin Sim identified CVE-2026-113914, a flaw allowing remote attackers to break out of the WebContent sandbox through improper input validation. Cisco Talos researchers Claudio Bozzato and Francesco Benvenuto uncovered CVE-2026-112690, an authorization failure requiring improved entitlement checks to prevent unauthorized access to user data.

# Example verification check for active OS build state
sw_vers
uname -mrs

Physical Access and Parsing Flaws Enable File Access

Physical and proximity vectors formed another core component of the October 2026 security advisory. Johnny Franks, Daniel, KennethLi, and an anonymous researcher reported CVE-2026-112612, which enabled an attacker with physical access to a trust-paired device to read and write arbitrary files due to path validation errors. Hcamael and 章鱼哥@aipy identified CVE-2026-112466, a null pointer dereference allowing a denial-of-service condition when an attacker remained in physical proximity.

Data structure parsing also contained critical attack surfaces. Neon, Niels Hofmans, and Mustafa Calap discovered CVE-2026-112678, where processing a maliciously crafted calendar invitation triggered memory corruption via an out-of-bounds write. Google Project Zero researcher Ivan Fratric identified CVE-2026-112619, an authorization flaw involving state management that let applications access protected user data. Additional permission restrictions were implemented to resolve CVE-2026-112566 and CVE-2026-113906, both reported by Chris Bailey of Short Circuit.

Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.

More on Apple: Apple Publishes Revisions to Its App Review Guidelines · New Apple TV 4K With A19 Chip Doubles Graphics, Techworld.hu Says · Apple Unveils New iPad Mini with OLED Display, Frandroid Reports