CVE-2026-112619
Low risk· EPSS 14%Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
An out-of-bounds write issue was addressed with improved bounds checking. Processing a maliciously crafted calendar invitation may lead to memory corruption.
Risk Assessment
An attacker could exploit a malicious calendar invitation to corrupt memory, potentially leading to a crash or code execution. This affects Apple devices running iOS, iPadOS, macOS, visionOS, and watchOS.
Recommendation
Update systems to the fixed versions: iOS/iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2, watchOS 27.2.
Other vulnerabilities in Apple iOS/iPadOS/macOS/visionOS/watchOS
See all- CVE-2026-84625Critical
A permissions issue was addressed with additional sandbox restrictions. The vulnerability affects iOS, iPadOS, macOS, visionOS, and watchOS. An app may be able to fingerprint the user.
- CVE-2025-43200MediumActively exploited
A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. This issue is fixed in iOS 15.8.4, iPadOS 15.8.4, iOS 16.7.11, iPadOS 16.7.11, iOS 18.3.1, iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, and watchOS 11.3.1. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
- CVE-2026-86870Medium
A heap buffer overflow was addressed with improved bounds checking. The vulnerability affects iOS, iPadOS, macOS, visionOS, and watchOS. Processing a maliciously crafted file may lead to unexpected app termination.
- CVE-2026-65412Medium
A null pointer dereference vulnerability in Apple systems, fixed with improved input validation. Processing web content may lead to a denial-of-service.
- CVE-2026-65403Medium
This issue was addressed with improved checks. The vulnerability affects iOS, iPadOS, macOS, visionOS, and watchOS. An app may be able to access sensitive user data.
- CVE-2026-65399Medium
A file quarantine bypass was addressed with additional checks. The vulnerability affects iOS, iPadOS, macOS, visionOS, and watchOS. An archive may be able to bypass Gatekeeper.
- CVE-2026-64734Medium
A vulnerability in Apple systems, fixed with improved checks. Processing a maliciously crafted contact may leak sensitive data.
- CVE-2026-28988Medium
A permissions issue was addressed with additional restrictions. The issue is fixed in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, and watchOS 26.5. An app may be able to bypass certain Privacy preferences.
- CVE-2026-28864Low
A local attacker may gain access to the user's Keychain items due to insufficient permissions checking. The issue was fixed in multiple versions of iOS, iPadOS, macOS, visionOS, and watchOS.
- CVE-2025-46288Medium
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An app may be able to access sensitive payment tokens.
Original NVD description (English source)
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted calendar invitation may lead to memory corruption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS