Apple iOS CVE-2026-112633

Exploitation requires a victim on an affected Apple OS (iOS/iPadOS before 26.7.2 or 27.2; macOS before 15.8.2, 26.7.2, or Golden Gate 27.2) to process a maliciously crafted image in a vulnerable app - this image-processing step is the mandatory trigger (UI:R). No authentication or prior privilege is needed (PR:N). The key limiting factors are that the attacker must get the victim to process the malicious image and that the confirmed impact is limited to app termination (availability only, C:N/I:N) rather than code execution or data disclosure, which substantially bounds real-world risk despite the network attack vector.

Signals are consistent and point to a moderate, non-urgent issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) describes a network-reachable, low-complexity flaw that needs user interaction and yields only an availability impact - Apple's description scopes it to 'unexpected app termination' (a crash), with no stated confidentiality or integrity loss. EPSS is low at 0.55% (46th percentile), the CVE is NOT in CISA KEV, and SSVC records Exploitation: none, Automatable: no, Technical Impact: partial, all of which agree that this is not currently being exploited and is not mass-exploitable. The vuln.today decision label is 'this_month,' i.e. routine patching rather than emergency. One point to note: the CWE is CWE-787 (out-of-bounds write), a class that can sometimes be escalated beyond a crash, yet both Apple's description and the CVSS impact metrics confine the consequence to availability (C:N/I:N) - treat code-execution potential as unverified, not confirmed. Overall this is a genuine but lower-priority image-parsing DoS, not a high-CVSS-but-illusory issue nor an active-exploitation emergency.

An attacker crafts a malformed image and delivers it to a victim through a website, message, or email attachment on an affected Apple device; when the image is processed by a vulnerable app, the out-of-bounds write triggers and the app terminates unexpectedly. No public exploit code or PoC reference is present in the supplied data, and the described outcome is a crash rather than code execution. User interaction (processing the image) is required per the CVSS vector.