Apple iOS CVE-2026-112688

Exploitation requires the victim to open or parse a maliciously crafted file in the affected application (UI:R); the flaw is reachable by a remote, unauthenticated attacker (AV:N/PR:N) who can deliver that file via web, email, or messaging, and requires no special configuration or elevated privileges. The exact file format and vulnerable parser are not named in the available sources, so the precise triggering input cannot be confirmed. The principal limiting factor is the mandatory user interaction - the file must actually be opened - which is why the SSVC framework marks exploitation as not automatable. Fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2; per Apple, updating is the remediation.

Signals are consistent and point to a serious-but-not-emergency issue. CVSS 3.1 is 8.8 (High) with AV:N/AC:L/PR:N/UI:R, meaning a remote, unauthenticated attacker can achieve full confidentiality, integrity and availability impact (C:H/I:H/A:H) but only after a user opens or parses a malicious file - the UI:R requirement is the single biggest limiter on real-world risk. Exploitation-likelihood signals are all low-to-none: EPSS is 0.64% (50th percentile), the vulnerability is NOT on the CISA KEV list, and the SSVC framework records Exploitation: none and Automatable: no (because user interaction defeats automated mass exploitation), even though it rates Technical Impact: total. No POC or exploit reference appears in the supplied data. These signals do not conflict: a high severity score driven by total technical impact coexists with low exploitation probability because delivery depends on tricking a user into opening a file. The vuln.today Decision label is 'this_week', so this is a real priority to patch promptly rather than a drop-everything emergency. Net: a genuinely high-severity memory-corruption RCE whose practical risk is moderated by the user-interaction requirement and the absence of any observed or automatable exploitation.

An attacker crafts a malformed file and delivers it to a victim via email, a website, or a messaging app; when the user opens or previews the file, the vulnerable parser mishandles memory (CWE-119), causing an unexpected app termination or arbitrary code execution within the affected application's context. The attack is unauthenticated (PR:N) with low complexity (AC:L) but requires the victim to open the file (UI:R). No public exploit identified at time of analysis.