Apple iOS CVE-2026-112629

Exploitation requires the victim to process a maliciously crafted image in an affected app (UI:R - user interaction is mandatory; no fully automatic or unattended trigger is indicated). No authentication is required (PR:N, unauthenticated), and the vector is network-reachable in the sense that the malicious image can be delivered remotely, but the attacker cannot force exploitation without the user opening/rendering the file. Exploitation is LIMITED to builds older than the fixed releases: iOS/iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.2; devices on or above these versions are not affected. The realistic impact ceiling is denial of service (app termination), not data exposure or code execution. Updating to the listed fixed versions is the vendor-provided remediation.

This is a genuine but moderate-priority issue, not a high-urgency emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 6.5) describes a network-reachable, low-complexity flaw that requires user interaction and produces an availability-only impact - there is no confidentiality (C:N) or integrity (I:N) loss. The signals are mutually consistent and all point away from active mass exploitation: EPSS is 0.60% (49th percentile, i.e. low-to-middling probability), the CVE is NOT on CISA KEV, and the CISA SSVC decision records Exploitation: none, Automatable: no, Technical Impact: partial. The vuln.today decision label is 'this_month', which aligns with a scheduled-patch rather than drop-everything posture. No public exploit or PoC reference appears anywhere in the supplied input. Net: a real memory-safety bug worth patching on a normal cycle, but its impact ceiling is app crash (denial of service), not code execution or data theft, so it is not a high-real-risk issue despite the medium CVSS. The one genuine risk amplifier is the enormous install base of the affected Apple platforms.

An attacker crafts a malicious image and delivers it to a victim via a message, web page, or email; when the user opens or the app renders the image, an out-of-bounds read is triggered and the application terminates unexpectedly (denial of service). No PoC or exploit code is present in the available data, and the UI:R requirement means the victim must actually process the attacker's image. Because the impact is limited to C:N/I:N/A:H, the realistic outcome is a crash rather than code execution or information disclosure.