Apple iOS 27.2 Released With Fixes for 163 Vulnerabilities, Including Fix for Critical WebKit RCE

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com


Apple released iOS 27.2 and iPadOS 27.2 on October 26, 2026, with fixes for 163 security flaws. The update covers iPhone 11 and later and a wide set of iPad models. The most serious issues sit in WebKit, the engine behind Safari and most in-app browsers on Apple devices. Apple says malicious web content could run code on a device. That is a remote code execution risk, and it is the reason this update should not wait.

Apple published the full list in its security content document for iOS 27.2 and iPadOS 27.2. The company does not report active use of these flaws in real attacks.

That does not make the patch optional. Once details are public, unpatched phones and tablets become easier targets. According to reports, none of the bugs were listed as exploited, and users are still urged to install the software soon.

WebKit RCE Vulnerabilities

WebKit is the largest group of fixes in this release. Apple credits more than 30 WebKit issues, and several of them can lead to code execution if a user opens a crafted page. The serious cases include use-after-free bugs and a type confusion bug.

In plain terms, the browser can mishandle memory after a page is closed or confuse one data type for another. An attacker can then use that mistake to run their own code inside the browser process.

The code execution fixes include CVE-2026-112697, CVE-2026-112655, CVE-2026-112651, and CVE-2026-112623, all tied to use-after-free flaws. CVE-2026-112659 is a type confusion issue. CVE-2026-112637, CVE-2026-112626, and CVE-2026-112639 are further use-after-free bugs in WebKit, WebKit Canvas, WebKit JavaScript bindings, and the WebKit process model.

Apple fixed them with better memory handling. Credits include OpenAI Codex Security researcher Amy Burnett, Chris Rohlf with Anthropic Research, Euntae Jang, Luke Francis, and others.

Two related sandbox issues raise the risk further. CVE-2026-113897 can let a remote attacker break out of the Web Content sandbox. Apple removed the vulnerable code. CVE-2026-112690, reported by Claudio Bozzato and Francesco Benvenuto of Cisco Talos, is listed under App Store and can also let a remote attacker leave the WebContent sandbox. A sandbox breakout matters because code that starts in the browser can then reach more of the device.

WebKit bugs have a long record of real-world use. Earlier this year, Cyber Security News reported that Apple patched a high-severity WebKit flaw that could bypass the Same Origin Policy. Older WebKit flaws have also been used in targeted spyware campaigns. This release does not carry that warning, but the pattern is why browser fixes on iPhone are treated as urgent.

Kernel, privacy, and File Vulnerabilities

The kernel fixes are the next concern. About 15 kernel bugs are patched. Several can crash the system or corrupt kernel memory. Some are use-after-free flaws, including CVE-2026-65350, CVE-2026-112679, CVE-2026-112517, and CVE-2026-112514. Others can write kernel memory or reveal the kernel memory layout, which helps an attacker plan a deeper break-in.

Kernel bugs usually need a malicious app or a prior foothold, so they are less direct than a web bug. They still matter in a chain, where a WebKit bug is the first step and a kernel bug is the second.

Privacy bugs are spread across everyday apps. An Apple Intelligence flaw, CVE-2026-86987, can let a remote attacker access sensitive user data on iPhone 15 Pro and later and on supported iPads. It was reported by Richard Hyunho Im of Route Zero Security.

A Hide My Email logic bug, CVE-2026-112500, can leak the user’s real email address. Other fixes cover Contacts, Calendar, CloudKit, Files, Photos, Siri, Shortcuts, and Screen Time. A Maps bug, CVE-2026-112707, could let an app see which other apps are installed. A CoreMedia bug, CVE-2026-86990, could let a malicious app use the camera without permission.

File parsing bugs are another large set. ImageIO, CoreGraphics, CoreAudio, FontParser, and Model I/O all received fixes for crafted images, PDFs, fonts, audio, and 3D models. Many of these only crash an app or leak process memory. A few can corrupt memory, which is a step toward code execution if an attacker can control what the device opens. A CoreMedia bug, CVE-2026-112688, can lead to code execution when a file is parsed.

Jailbreak fixes and who should update

Six entries credit Calif, the team that jailbroke the iPhone Duo on launch day and showed an untethered jailbreak on iOS 27.0.1. Calif researcher Stefan Esser has said that most of the bugs used for that jailbreak are fixed in iOS 27.2.

That is good news for device security and a setback for people who want a jailbreak. It also shows why waiting on a large Apple patch is a poor idea. Public research often follows a jailbreak demo.

Apple also shipped iOS 26.7.2 and iPadOS 26.7.2 the same day for devices that have not moved to iOS 27. Those builds carry many of the same fixes. Users still on iOS 26 should install 26.7.2 rather than skip the update because they are not on the newest major release.

Supported hardware for iOS 27.2 starts at iPhone 11, iPad Pro 12.9-inch 4th generation, iPad Pro 11-inch 2nd generation, iPad Air 4th generation, iPad 9th generation, and iPad mini 6th generation.

To install the update, open Settings, tap General, then Software Update, and follow the prompt. A backup before a major point release is still wise. Organizations should treat this as a priority patch because of the WebKit code execution bugs, the sandbox escapes, and the size of the kernel set. Apple’s record on large multi-platform security updates shows the same pattern. Browser and kernel flaws arrive together, and delayed installs leave the widest window for abuse.

Component CVE ID(s) Security impact Issue and fix
Accelerate Framework CVE-2026-86971 Processing a maliciously crafted image may lead to unexpected app termination An out-of-bounds write issue was addressed with improved bounds checking.
AccessorySetupKit CVE-2026-84493 A malicious app may be able to access Bluetooth without user consent An authentication issue was addressed with improved state management.
Accounts CVE-2026-113898 A malicious application may be able to bypass Privacy preferences A logging issue was addressed with improved data redaction.
Accounts CVE-2026-112446 An app may be able to access sensitive user data This issue was addressed with additional entitlement checks.
Accounts CVE-2026-112612 An attacker with physical access to a trust-paired device may be able to read and write arbitrary files A path handling issue was addressed with improved validation.
App Intents CVE-2026-112692 An app may be able to access sensitive user data This issue was addressed with additional entitlement checks.
App Store CVE-2026-113914 An app may be able to access sensitive user data An authorization issue was addressed with improved state management.
App Store CVE-2026-112690 A remote attacker may be able to break out of the WebContent sandbox This issue was addressed with improved input validation.
Apple Intelligence CVE-2026-86987 A remote attacker may be able to access sensitive user data An authorization issue was addressed with improved entitlement checks.
Apple Neural Engine CVE-2026-112696 An app may be able to cause unexpected system termination or corrupt kernel memory An out-of-bounds write issue was addressed with improved bounds checking.
Apple Neural Engine CVE-2026-84494 An app may be able to cause unexpected system termination or write kernel memory An out-of-bounds write issue was addressed with improved bounds checking.
AppleAVD CVE-2026-112416 Processing a maliciously crafted video file may lead to unexpected app termination An out-of-bounds write issue was addressed with improved bounds checking.
AppleAVD CVE-2026-112415 An app may be able to cause unexpected system termination or corrupt process memory An out-of-bounds write was addressed with improved input validation.
AppleAVD CVE-2026-112454 Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory The issue was addressed with improved memory handling.
Audio CVE-2026-112546 Processing a maliciously crafted file may lead to unexpected app termination An out-of-bounds read was addressed with improved bounds checking.
AVEVideoEncoder CVE-2026-112705 An app may be able to cause unexpected system termination An out-of-bounds write issue was addressed with improved bounds checking.
AVEVideoEncoder CVE-2026-112689 An app may be able to cause unexpected system termination or corrupt kernel memory An out-of-bounds write issue was addressed with improved input validation.
AVEVideoEncoder CVE-2026-112470, CVE-2026-112469, CVE-2026-112468 An app may be able to cause unexpected system termination or corrupt kernel memory An out-of-bounds write issue was addressed with improved bounds checking.
AVEVideoEncoder CVE-2026-112466 An app may be able to cause unexpected system termination or read kernel memory An out-of-bounds read was addressed with improved input validation.
Bluetooth CVE-2026-112566, CVE-2026-113906 An attacker in physical proximity may be able to cause a denial-of-service A null pointer dereference was addressed with improved validation.
Calendar CVE-2026-112678 An app may be able to access sensitive user data A permissions issue was addressed with additional restrictions.
Calendar CVE-2026-112619 Processing a maliciously crafted calendar invitation may lead to memory corruption An out-of-bounds write issue was addressed with improved bounds checking.
CloudKit CVE-2026-112701 An app may be able to access sensitive user data An authorization issue was addressed with improved state management.
ColorSync CVE-2026-86988 Processing a maliciously crafted image may result in disclosure of process memory The issue was addressed with improved checks.
Compression CVE-2026-113910 An app may be able to disclose kernel memory A memory initialization issue was addressed with improved memory handling.
Contacts CVE-2026-113908 An app may be able to access sensitive user data A privacy issue was addressed by removing sensitive data.
CoreAudio CVE-2026-113912 Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory An out-of-bounds access issue was addressed with improved bounds checking.
CoreAudio CVE-2026-113907 An app may be able to cause unexpected system termination or corrupt process memory A buffer overflow issue was addressed with improved memory handling.
CoreAudio CVE-2026-86972 Processing a maliciously crafted audio file may lead to memory corruption A buffer overflow was addressed with improved size validation.
CoreAudio CVE-2026-86969 An app may be able to cause unexpected system termination or corrupt kernel memory An out-of-bounds write was addressed with improved input validation.
CoreAudio CVE-2026-112638 An attacker in radio range may be able to cause unexpected system termination A heap buffer overflow was addressed with improved bounds checking.
CoreGraphics CVE-2026-112611, CVE-2026-112610 Processing a maliciously crafted PDF file may lead to memory corruption An out-of-bounds write issue was addressed with improved bounds checking.
CoreGraphics CVE-2026-113950 Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory An out-of-bounds write issue was addressed with improved bounds checking.
CoreMedia CVE-2026-86992 Processing a maliciously crafted video file may lead to unexpected app termination The issue was addressed with improved memory handling.
CoreMedia CVE-2026-112706 An app may be able to access sensitive user data A permissions issue was addressed with additional restrictions.
CoreMedia CVE-2026-112688 Parsing a file may lead to an unexpected app termination or arbitrary code execution A memory corruption issue was addressed with improved memory handling.
CoreMedia CVE-2026-86990 A malicious app may be able to access the camera without user permission An access issue was addressed with improved access restrictions.
CoreText CVE-2026-112656 Processing a maliciously crafted font may result in the disclosure of process memory An out-of-bounds read was addressed with improved bounds checking.
FileProvider CVE-2026-113896 An app may be able to access sensitive user data A race condition was addressed with additional validation.
Files CVE-2026-112618 An app may be able to access sensitive user data An access issue was addressed with improved access restrictions.
FontParser CVE-2026-86970 Processing a maliciously crafted font may result in the disclosure of process memory An out-of-bounds read was addressed with improved input validation.
FontParser CVE-2026-112683 Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory An out-of-bounds write issue was addressed with improved bounds checking.
FontParser CVE-2026-112642 Processing a maliciously crafted font may result in the disclosure of process memory An out-of-bounds read was addressed with improved bounds checking.
FontParser CVE-2026-112432 An app may be able to access sensitive user data A logging issue was addressed with improved data redaction.
Heimdal CVE-2026-112518 An attacker in a privileged network position may be able to impersonate a Kerberos KDC An issue with signature validation was addressed with improved checks.
HFS CVE-2026-112456 Processing a maliciously crafted file may lead to heap corruption An out-of-bounds write issue was addressed with improved input validation.
HomeKit CVE-2026-86978 An app may be able to access sensitive user data This issue was addressed with improved checks.
HomeKit CVE-2026-112596 Processing a maliciously crafted video file may lead to unexpected system termination An integer overflow was addressed with improved bounds checking.
ImageIO CVE-2026-112571 Processing a maliciously crafted image may result in disclosure of process memory A memory initialization issue was addressed with improved memory handling.
ImageIO CVE-2026-112561, CVE-2026-112627 Processing a maliciously crafted image may result in disclosure of process memory An out-of-bounds read was addressed with improved bounds checking.
ImageIO CVE-2026-112488 Processing a maliciously crafted image may corrupt process memory A buffer overflow issue was addressed with improved memory handling.
ImageIO CVE-2026-112634, CVE-2026-112629 Processing a maliciously crafted image may lead to unexpected app termination An out-of-bounds read was addressed with improved bounds checking.
ImageIO CVE-2026-112633, CVE-2026-112614 Processing a maliciously crafted image may lead to unexpected app termination An out-of-bounds write issue was addressed with improved bounds checking.
ImageIO CVE-2026-112632, CVE-2026-112630 Processing a maliciously crafted image may result in disclosure of process memory An uninitialized memory issue was addressed with improved memory handling.
ImageIO CVE-2026-112625 Processing a maliciously crafted image may result in memory corruption An integer underflow was addressed with improved input validation.
IOHIDFamily CVE-2026-112515 An attacker may be able to cause unexpected system termination or read kernel memory An out-of-bounds read was addressed with improved bounds checking.
IOKit CVE-2026-65385 A buffer overflow may result in memory corruption and unexpected app termination An out-of-bounds write issue was addressed with improved bounds checking.
IOMobileFrameBuffer CVE-2026-112459 An app may be able to cause unexpected system termination or corrupt kernel memory A race condition was addressed with improved state handling.
IOStorageFamily CVE-2026-112554 An app may be able to cause unexpected system termination or read kernel memory An out-of-bounds read was addressed with improved bounds checking.
IOSurface CVE-2026-112477 An app may be able to cause unexpected system termination or corrupt kernel memory A race condition was addressed with improved locking.
Kernel CVE-2026-112576 An app may be able to cause unexpected changes to copy-on-write memory A memory integrity issue was addressed with improved handling of copy-on-write pages.
Kernel CVE-2026-112606 An app may be able to cause unexpected system termination A type confusion issue was addressed with improved memory handling.
Kernel CVE-2026-65350, CVE-2026-112679 An app may be able to cause unexpected system termination or corrupt kernel memory A use-after-free issue was addressed with improved memory management.
Kernel CVE-2026-112517 An app may be able to cause unexpected system termination or corrupt kernel memory A use after free issue was addressed with improved memory management.
Kernel CVE-2026-112516 An app may be able to cause unexpected system termination A use-after-free issue was addressed with improved memory management.
Kernel CVE-2026-112514 An attacker may be able to cause unexpected system termination or corrupt kernel memory A use-after-free issue was addressed with improved memory management.
Kernel CVE-2026-112507 An app may be able to cause unexpected system termination or write kernel memory An out-of-bounds write issue was addressed with improved bounds checking.
Kernel CVE-2026-84495, CVE-2026-112474 An app may be able to cause unexpected system termination or write kernel memory A use-after-free issue was addressed with improved memory management.
Kernel CVE-2026-112698 An app may be able to cause unexpected system termination The issue was addressed with improved memory handling.
Kernel CVE-2026-112501 An app may be able to cause unexpected system termination A race condition was addressed with improved state handling.
Kernel CVE-2026-112476 An app may be able to cause unexpected system termination An out-of-bounds read was addressed with improved bounds checking.
Kernel CVE-2026-112665 An app may be able to determine kernel memory layout An information disclosure issue was addressed with improved state management.
Kernel CVE-2026-112624 An app may be able to bypass Privacy preferences This issue was addressed with improved checks.
libarchive CVE-2026-112522 Processing a maliciously crafted file may lead to unexpected app termination An out-of-bounds write issue was addressed with improved bounds checking.
LinkPresentation CVE-2026-112621 Processing a maliciously crafted image may result in memory corruption An out-of-bounds write issue was addressed with improved bounds checking.
Mail CVE-2026-112500 The user’s original email address may be leaked when using the Hide My Email feature A logic issue was addressed with improved restrictions.
Mail CVE-2026-112671 A remote attacker may be able to cause a denial-of-service A resource exhaustion issue was addressed with improved input validation.
Mail CVE-2026-112414 Processing a maliciously crafted message may lead to a denial-of-service A stack overflow was addressed with improved input validation.
Maps CVE-2026-112707 An app may be able to identify what other apps a user has installed A privacy issue was addressed by moving sensitive data to a protected location.
mDNSResponder CVE-2026-112607 A remote attacker may be able to leak memory An out-of-bounds read was addressed with improved bounds checking.
MediaAnalysis CVE-2026-113915 An app may be able to access sensitive user data A race condition was addressed with additional validation.
MediaRemote CVE-2026-112687 An attacker on the local network may be able to cause unexpected system termination or corrupt process memory This issue was addressed by removing the vulnerable code.
Messages CVE-2026-112682 A remote attacker may be able to cause unexpected app termination An input validation issue was addressed with improved input validation.
MobileGestalt CVE-2026-86989 An app may be able to fingerprint the user An authorization issue was addressed with improved state management.
Model I/O CVE-2026-112565, CVE-2026-112449 Processing a maliciously crafted 3D model may lead to memory corruption An integer overflow was addressed with improved input validation.
Model I/O CVE-2026-112413 Processing a maliciously crafted file may lead to unexpected app termination An out-of-bounds read was addressed with improved bounds checking.
Model I/O CVE-2026-112485 Processing a maliciously crafted 3D model may lead to memory corruption The issue was addressed with improved memory handling.
Model I/O CVE-2026-112461 Processing a maliciously crafted 3D model may lead to memory corruption An out-of-bounds write issue was addressed with improved bounds checking.
Model I/O CVE-2026-112486 Processing a 3D model may lead to unexpected app termination An out-of-bounds write issue was addressed with improved bounds checking.
Photos Storage CVE-2026-65397 An app may be able to access sensitive user data An authorization issue was addressed with improved state management.
Photos Storage CVE-2026-112676 An app may be able to access a user’s Photos Library This issue was addressed with additional entitlement checks.
Photos Storage CVE-2026-112660 An app may be able to bypass certain Privacy preferences An authorization issue was addressed with improved state management.
Power Management CVE-2026-112681 An app may be able to fingerprint the user This issue was addressed with additional entitlement checks.
Quick Look CVE-2026-86925 An app may be able to access sensitive user data An authorization issue was addressed with improved state management.
RealityKit CVE-2026-112491 Processing a maliciously crafted file may lead to unexpected app termination An out-of-bounds read was addressed with improved bounds checking.
ReplayKit CVE-2026-112547 An app may be able to access sensitive user data A type confusion issue was addressed with improved checks.
Safety Check CVE-2026-112609 An app may be able to access sensitive user data This issue was addressed with improved checks.
SceneKit CVE-2026-112425 Processing a 3D model may result in disclosure of process memory An out-of-bounds read was addressed with improved bounds checking.
SceneKit CVE-2026-112423 Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents An out-of-bounds read was addressed with improved bounds checking.
SceneKit CVE-2026-112464 Processing a maliciously crafted file may lead to heap corruption An out-of-bounds write issue was addressed with improved input validation.
SceneKit CVE-2026-86991 Processing a maliciously crafted file may lead to unexpected process termination A buffer overflow was addressed with improved bounds checking.
Screen Time CVE-2026-112616 An app may be able to access sensitive user data An authorization issue was addressed with improved access control.
Security CVE-2026-113913 Processing web content may disclose sensitive information An input validation issue was addressed with improved input validation.
Security CVE-2026-112652 An malicious app may be able to bypass certificate validation A logic issue was addressed with improved state management.
Shortcuts CVE-2026-112559, CVE-2026-112455 An app may be able to access sensitive user data An authorization issue was addressed with improved state management.
Siri CVE-2026-112658 An app may be able to access sensitive user data This issue was addressed with improved input validation.
Siri CVE-2026-112685 An app may be able to access sensitive user data An authorization issue was addressed with improved state management.
Spotlight CVE-2022-26704 An app may be able to gain elevated privileges A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.
Spotlight CVE-2026-112567 A malicious application may be able to bypass Privacy preferences This issue was addressed with improved checks.
Spotlight CVE-2026-112628 An app may be able to access sensitive user data This issue was addressed with improved data access restriction.
SpringBoard CVE-2026-112646 An app may be able to cause unexpected system termination or corrupt process memory An out-of-bounds write issue was addressed with improved bounds checking.
SwiftUI CVE-2026-112691 An app may be able to cause unexpected system termination An out-of-bounds write issue was addressed with improved input validation.
System Preferences CVE-2026-86968 A malicious app may be able to access restricted system interfaces or launder launch attribution An access issue was addressed with improved access control.
TextKit CVE-2026-84605 An app may be able to read the device’s name An authorization issue was addressed with improved state management.
Thread CVE-2026-112595 An attacker in physical proximity may be able to craft malicious network traffic to gain access to a Thread network This issue was addressed with improved authentication.
USB CVE-2026-112479 A malicious USB device may be able to cause unexpected system termination or read kernel memory An out-of-bounds read was addressed with improved bounds checking.
WebKit CVE-2026-113904, CVE-2026-112599 Processing maliciously crafted web content may lead to an unexpected process crash A use-after-free issue was addressed with improved memory management.
WebKit CVE-2026-86974 Processing maliciously crafted web content may lead to memory corruption A type confusion issue was addressed with improved checks.
WebKit CVE-2026-86986, CVE-2026-112693 Processing maliciously crafted web content may lead to an unexpected Safari crash A use-after-free issue was addressed with improved memory management.
WebKit CVE-2026-86985 Processing maliciously crafted web content may lead to an unexpected process crash This issue was addressed with improved input validation.
WebKit CVE-2026-112699, CVE-2026-112680 Processing maliciously crafted web content may result in the disclosure of process memory An out-of-bounds read was addressed with improved bounds checking.
WebKit CVE-2026-112697, CVE-2026-112655, CVE-2026-112651, CVE-2026-112623 Processing maliciously crafted web content may lead to arbitrary code execution A use-after-free issue was addressed with improved memory management.
WebKit CVE-2026-112686 Processing maliciously crafted web content may lead to an unexpected process termination A race condition was addressed with improved locking.
WebKit CVE-2026-112684 Processing maliciously crafted web content may lead to an unexpected process crash This issue was addressed through improved state management.
WebKit CVE-2026-112673 Processing maliciously crafted web content may lead to an unexpected process termination A type confusion issue was addressed with improved state handling.
WebKit CVE-2026-112669 Processing maliciously crafted web content may lead to an unexpected Safari crash A race condition was addressed with improved state handling.
WebKit CVE-2026-112695, CVE-2026-112666, CVE-2026-112654, CVE-2026-112653, CVE-2026-112615 Processing maliciously crafted web content may lead to an unexpected process termination A use-after-free issue was addressed with improved memory management.
WebKit CVE-2026-112659 Processing maliciously crafted web content may lead to arbitrary code execution A type confusion issue was addressed with improved memory handling.
WebKit CVE-2026-112640 Processing maliciously crafted web content may lead to memory corruption A use-after-free issue was addressed with improved memory management.
WebKit CVE-2026-113952 A website may be able to use a media format that should be restricted in Lockdown Mode A logic issue was addressed with improved checks.
WebKit CVE-2026-113949 Processing maliciously crafted web content may lead to memory corruption A type confusion issue was addressed with improved state management.
WebKit CVE-2026-113903 Processing maliciously crafted web content may lead to unexpected memory modification A use-after-free issue was addressed with improved memory management.
WebKit Canvas CVE-2026-112637 Processing maliciously crafted web content may lead to arbitrary code execution A use-after-free issue was addressed with improved memory management.
WebKit JavaScript Bindings CVE-2026-112626 Processing maliciously crafted web content may lead to arbitrary code execution A use-after-free issue was addressed with improved memory management.
WebKit Process Model CVE-2026-113897 A remote attacker may be able to break out of Web Content sandbox This issue was addressed by removing the vulnerable code.
WebKit Process Model CVE-2026-112639 Processing maliciously crafted web content may lead to arbitrary code execution A use-after-free issue was addressed with improved memory management.
WebRTC CVE-2026-113901 Processing maliciously crafted web content may lead to an unexpected process crash A use-after-free issue was addressed with improved memory management.
WebRTC CVE-2026-86973 Processing maliciously crafted web content may lead to an unexpected process crash An out-of-bounds read was addressed with improved bounds checking.
Wi-Fi CVE-2026-113909 An attacker in physical proximity may be able to corrupt process memory A memory corruption issue was addressed with improved input validation.
Wi-Fi CVE-2026-112622 An attacker in radio range may be able to cause unexpected system termination An out-of-bounds read was addressed with improved bounds checking.
Wi-Fi CVE-2026-112620 An attacker in a privileged network position may be able to cause a denial-of-service A denial-of-service issue was addressed with improved input validation.

Apple has not assigned public severity scores in the advisory, and it has not said any of these bugs are under attack. The practical reading is still clear. A crafted website is enough to hit the worst WebKit bugs, and the fixes are already shipping. Update iPhone and iPad devices to iOS 27.2 or iPadOS 27.2, or to iOS 26.7.2 if the device is still on the older branch.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Apple iOS 27.2 Released With Fixes for 163 Vulnerabilities, Including Fix for Critical WebKit RCE appeared first on Cyber Security News.