Apple iOS CVE-2026-112634

Exploitation requires a victim running an affected Apple OS version prior to the fixes (iOS/iPadOS before 26.7.2 or 27.2, macOS before 15.8.2 / 26.7.2 / 27.2, visionOS before 27.2) to process a maliciously crafted image. The CVSS vector requires user interaction (UI:R), so the victim must open or render the attacker-supplied image; no authentication is needed (PR:N) and the image can be delivered remotely (AV:N). The outcome is limited to unexpected app termination (A:H, with C:N/I:N) - a denial of service, not code execution or data leakage - which is the primary factor limiting real-world severity. The specific image format and the parsing component are not described in the available sources.

The signals align consistently toward moderate-to-low real-world urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) describes a network-reachable, low-complexity, unauthenticated flaw whose ONLY impact is availability (A:H) - i.e. unexpected application termination - with no confidentiality or integrity impact (C:N/I:N), and it requires user interaction (UI:R) to open a crafted image. EPSS is 0.58% (48th percentile), indicating low predicted exploitation probability. There is no CISA KEV listing and no public exploit identified at time of analysis. CISA SSVC reinforces this: Exploitation=none, Automatable=no, Technical Impact=partial. The vendor-priority decision label is 'this_month', not act_now or emergency. Net: this is a denial-of-service (image-parsing crash) rather than a code-execution or data-theft bug, so it is a routine-patch item rather than a drop-everything priority. One discrepancy to note: the input Tags include 'Information Disclosure' and 'Buffer Overflow', but the CVSS vector sets C:N and the description states only app termination, so an info-disclosure characterization is not supported by the supplied evidence - treat the impact as availability-only unless the vendor states otherwise.

An attacker crafts a malicious image and delivers it to a victim through a web page, message, or email on an unpatched Apple device. When the victim's app processes or renders the image, an out-of-bounds read is triggered and the application terminates unexpectedly. No public exploit code has been identified, and the impact is limited to a crash (denial of service), not code execution or data disclosure.