IOS 27.2 And IPadOS 27.2: Apple Security Update Released

Apple has rolled out iOS 27.2 and iPadOS 27.2 with security fixes for 163 vulnerabilities. Released on October 26, 2026, the update addresses problems affecting web browsing, system memory, privacy, and several built-in apps.

The most important fixes involve WebKit, the technology used by Safari and many in-app browsers. Apple warns that specially crafted web content could trigger code execution on an affected device.

Apple has not reported that these vulnerabilities are being actively exploited. However, users should not delay installing the update, especially because public technical details can help attackers identify unpatched devices.

WebKit and Kernel Flaws Receive Major Fixes

WebKit accounts for a significant portion of the security fixes. Some vulnerabilities involve memory-handling errors that could allow malicious web content to execute code.

The affected issues include:

Use-after-free flaws: Problems that occur when software continues using memory after it has been released.
Type confusion: Errors that cause software to handle data as the wrong type, potentially leading to memory corruption.
Sandbox escapes: Weaknesses that could allow an attacker to move beyond the restrictions placed on browser content.

Apple also addressed CVE-2026-113897, a vulnerability that could allow a remote attacker to escape the Web Content sandbox. Another issue, CVE-2026-112690, was listed under App Store security and also concerns sandbox escape.

The update includes numerous kernel fixes as well. These address problems such as memory corruption, unexpected system crashes, and possible disclosure of kernel memory information.

Kernel vulnerabilities can become especially dangerous when combined with another flaw. For example, an attacker might first exploit a browser vulnerability and then attempt to use a kernel issue to gain deeper access to the device.

Privacy and Built-In App Vulnerabilities

The update also fixes issues across Apple services and applications, including Apple Intelligence, Hide My Email, Contacts, Calendar, CloudKit, Files, Photos, Siri, Shortcuts, and Screen Time.

Some of the reported risks include:

Apple Intelligence: CVE-2026-86987 could expose sensitive user data on affected devices.
Hide My Email: CVE-2026-112500 could reveal a user’s actual email address.
Maps: CVE-2026-112707 could allow an app to identify other installed applications.
CoreMedia: CVE-2026-86990 could allow a malicious app to access the camera without permission.

Apple also corrected file-processing vulnerabilities affecting components such as ImageIO, CoreGraphics, CoreAudio, FontParser, and Model I/O. Depending on the flaw, specially crafted files could cause crashes, expose memory, or potentially lead to code execution.

The release also includes fixes for vulnerabilities associated with recent iPhone jailbreak research. This demonstrates how security weaknesses discovered by researchers can affect the wider security of Apple devices.

Which Devices Should Update?

Apple released iOS 27.2 for supported iPhones, starting with the iPhone 11 generation, along with iPadOS 27.2 for compatible iPads.

Users who remain on the previous major operating system can also check for iOS 26.7.2 or iPadOS 26.7.2, which provide security fixes for supported older software versions.

To install the update:

Open Settings on your iPhone or iPad.
Select General, then Software Update.
Download and install the available update.

Back up important data before installing, and allow the device to restart and complete the process.

The key takeaway: This release addresses a broad set of security weaknesses, including browser code execution and sandbox escape risks. Keeping Apple devices updated helps reduce exposure to known vulnerabilities and strengthens protection for personal and organizational data.

Component	CVE ID(s)	Security impact	Issue and fix
Accelerate Framework	CVE-2026-86971	Processing a maliciously crafted image may lead to unexpected app termination	An out-of-bounds write issue was addressed with improved bounds checking.
AccessorySetupKit	CVE-2026-84493	A malicious app may be able to access Bluetooth without user consent	An authentication issue was addressed with improved state management.
Accounts	CVE-2026-113898	A malicious application may be able to bypass Privacy preferences	A logging issue was addressed with improved data redaction.
Accounts	CVE-2026-112446	An app may be able to access sensitive user data	This issue was addressed with additional entitlement checks.
Accounts	CVE-2026-112612	An attacker with physical access to a trust-paired device may be able to read and write arbitrary files	A path handling issue was addressed with improved validation.
App Intents	CVE-2026-112692	An app may be able to access sensitive user data	This issue was addressed with additional entitlement checks.
App Store	CVE-2026-113914	An app may be able to access sensitive user data	An authorization issue was addressed with improved state management.
App Store	CVE-2026-112690	A remote attacker may be able to break out of the WebContent sandbox	This issue was addressed with improved input validation.
Apple Intelligence	CVE-2026-86987	A remote attacker may be able to access sensitive user data	An authorization issue was addressed with improved entitlement checks.
Apple Neural Engine	CVE-2026-112696	An app may be able to cause unexpected system termination or corrupt kernel memory	An out-of-bounds write issue was addressed with improved bounds checking.
Apple Neural Engine	CVE-2026-84494	An app may be able to cause unexpected system termination or write kernel memory	An out-of-bounds write issue was addressed with improved bounds checking.
AppleAVD	CVE-2026-112416	Processing a maliciously crafted video file may lead to unexpected app termination	An out-of-bounds write issue was addressed with improved bounds checking.
AppleAVD	CVE-2026-112415	An app may be able to cause unexpected system termination or corrupt process memory	An out-of-bounds write was addressed with improved input validation.
AppleAVD	CVE-2026-112454	Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory	The issue was addressed with improved memory handling.
Audio	CVE-2026-112546	Processing a maliciously crafted file may lead to unexpected app termination	An out-of-bounds read was addressed with improved bounds checking.
AVEVideoEncoder	CVE-2026-112705	An app may be able to cause unexpected system termination	An out-of-bounds write issue was addressed with improved bounds checking.
AVEVideoEncoder	CVE-2026-112689	An app may be able to cause unexpected system termination or corrupt kernel memory	An out-of-bounds write issue was addressed with improved input validation.
AVEVideoEncoder	CVE-2026-112470, CVE-2026-112469, CVE-2026-112468	An app may be able to cause unexpected system termination or corrupt kernel memory	An out-of-bounds write issue was addressed with improved bounds checking.
AVEVideoEncoder	CVE-2026-112466	An app may be able to cause unexpected system termination or read kernel memory	An out-of-bounds read was addressed with improved input validation.
Bluetooth	CVE-2026-112566, CVE-2026-113906	An attacker in physical proximity may be able to cause a denial-of-service	A null pointer dereference was addressed with improved validation.
Calendar	CVE-2026-112678	An app may be able to access sensitive user data	A permissions issue was addressed with additional restrictions.
Calendar	CVE-2026-112619	Processing a maliciously crafted calendar invitation may lead to memory corruption	An out-of-bounds write issue was addressed with improved bounds checking.
CloudKit	CVE-2026-112701	An app may be able to access sensitive user data	An authorization issue was addressed with improved state management.
ColorSync	CVE-2026-86988	Processing a maliciously crafted image may result in disclosure of process memory	The issue was addressed with improved checks.
Compression	CVE-2026-113910	An app may be able to disclose kernel memory	A memory initialization issue was addressed with improved memory handling.
Contacts	CVE-2026-113908	An app may be able to access sensitive user data	A privacy issue was addressed by removing sensitive data.
CoreAudio	CVE-2026-113912	Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory	An out-of-bounds access issue was addressed with improved bounds checking.
CoreAudio	CVE-2026-113907	An app may be able to cause unexpected system termination or corrupt process memory	A buffer overflow issue was addressed with improved memory handling.
CoreAudio	CVE-2026-86972	Processing a maliciously crafted audio file may lead to memory corruption	A buffer overflow was addressed with improved size validation.
CoreAudio	CVE-2026-86969	An app may be able to cause unexpected system termination or corrupt kernel memory	An out-of-bounds write was addressed with improved input validation.
CoreAudio	CVE-2026-112638	An attacker in radio range may be able to cause unexpected system termination	A heap buffer overflow was addressed with improved bounds checking.
CoreGraphics	CVE-2026-112611, CVE-2026-112610	Processing a maliciously crafted PDF file may lead to memory corruption	An out-of-bounds write issue was addressed with improved bounds checking.
CoreGraphics	CVE-2026-113950	Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory	An out-of-bounds write issue was addressed with improved bounds checking.
CoreMedia	CVE-2026-86992	Processing a maliciously crafted video file may lead to unexpected app termination	The issue was addressed with improved memory handling.
CoreMedia	CVE-2026-112706	An app may be able to access sensitive user data	A permissions issue was addressed with additional restrictions.
CoreMedia	CVE-2026-112688	Parsing a file may lead to an unexpected app termination or arbitrary code execution	A memory corruption issue was addressed with improved memory handling.
CoreMedia	CVE-2026-86990	A malicious app may be able to access the camera without user permission	An access issue was addressed with improved access restrictions.
CoreText	CVE-2026-112656	Processing a maliciously crafted font may result in the disclosure of process memory	An out-of-bounds read was addressed with improved bounds checking.
FileProvider	CVE-2026-113896	An app may be able to access sensitive user data	A race condition was addressed with additional validation.
Files	CVE-2026-112618	An app may be able to access sensitive user data	An access issue was addressed with improved access restrictions.
FontParser	CVE-2026-86970	Processing a maliciously crafted font may result in the disclosure of process memory	An out-of-bounds read was addressed with improved input validation.
FontParser	CVE-2026-112683	Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory	An out-of-bounds write issue was addressed with improved bounds checking.
FontParser	CVE-2026-112642	Processing a maliciously crafted font may result in the disclosure of process memory	An out-of-bounds read was addressed with improved bounds checking.
FontParser	CVE-2026-112432	An app may be able to access sensitive user data	A logging issue was addressed with improved data redaction.
Heimdal	CVE-2026-112518	An attacker in a privileged network position may be able to impersonate a Kerberos KDC	An issue with signature validation was addressed with improved checks.
HFS	CVE-2026-112456	Processing a maliciously crafted file may lead to heap corruption	An out-of-bounds write issue was addressed with improved input validation.
HomeKit	CVE-2026-86978	An app may be able to access sensitive user data	This issue was addressed with improved checks.
HomeKit	CVE-2026-112596	Processing a maliciously crafted video file may lead to unexpected system termination	An integer overflow was addressed with improved bounds checking.
ImageIO	CVE-2026-112571	Processing a maliciously crafted image may result in disclosure of process memory	A memory initialization issue was addressed with improved memory handling.
ImageIO	CVE-2026-112561, CVE-2026-112627	Processing a maliciously crafted image may result in disclosure of process memory	An out-of-bounds read was addressed with improved bounds checking.
ImageIO	CVE-2026-112488	Processing a maliciously crafted image may corrupt process memory	A buffer overflow issue was addressed with improved memory handling.
ImageIO	CVE-2026-112634, CVE-2026-112629	Processing a maliciously crafted image may lead to unexpected app termination	An out-of-bounds read was addressed with improved bounds checking.
ImageIO	CVE-2026-112633, CVE-2026-112614	Processing a maliciously crafted image may lead to unexpected app termination	An out-of-bounds write issue was addressed with improved bounds checking.
ImageIO	CVE-2026-112632, CVE-2026-112630	Processing a maliciously crafted image may result in disclosure of process memory	An uninitialized memory issue was addressed with improved memory handling.
ImageIO	CVE-2026-112625	Processing a maliciously crafted image may result in memory corruption	An integer underflow was addressed with improved input validation.
IOHIDFamily	CVE-2026-112515	An attacker may be able to cause unexpected system termination or read kernel memory	An out-of-bounds read was addressed with improved bounds checking.
IOKit	CVE-2026-65385	A buffer overflow may result in memory corruption and unexpected app termination	An out-of-bounds write issue was addressed with improved bounds checking.
IOMobileFrameBuffer	CVE-2026-112459	An app may be able to cause unexpected system termination or corrupt kernel memory	A race condition was addressed with improved state handling.
IOStorageFamily	CVE-2026-112554	An app may be able to cause unexpected system termination or read kernel memory	An out-of-bounds read was addressed with improved bounds checking.
IOSurface	CVE-2026-112477	An app may be able to cause unexpected system termination or corrupt kernel memory	A race condition was addressed with improved locking.
Kernel	CVE-2026-112576	An app may be able to cause unexpected changes to copy-on-write memory	A memory integrity issue was addressed with improved handling of copy-on-write pages.
Kernel	CVE-2026-112606	An app may be able to cause unexpected system termination	A type confusion issue was addressed with improved memory handling.
Kernel	CVE-2026-65350, CVE-2026-112679	An app may be able to cause unexpected system termination or corrupt kernel memory	A use-after-free issue was addressed with improved memory management.
Kernel	CVE-2026-112517	An app may be able to cause unexpected system termination or corrupt kernel memory	A use after free issue was addressed with improved memory management.
Kernel	CVE-2026-112516	An app may be able to cause unexpected system termination	A use-after-free issue was addressed with improved memory management.
Kernel	CVE-2026-112514	An attacker may be able to cause unexpected system termination or corrupt kernel memory	A use-after-free issue was addressed with improved memory management.
Kernel	CVE-2026-112507	An app may be able to cause unexpected system termination or write kernel memory	An out-of-bounds write issue was addressed with improved bounds checking.
Kernel	CVE-2026-84495, CVE-2026-112474	An app may be able to cause unexpected system termination or write kernel memory	A use-after-free issue was addressed with improved memory management.
Kernel	CVE-2026-112698	An app may be able to cause unexpected system termination	The issue was addressed with improved memory handling.
Kernel	CVE-2026-112501	An app may be able to cause unexpected system termination	A race condition was addressed with improved state handling.
Kernel	CVE-2026-112476	An app may be able to cause unexpected system termination	An out-of-bounds read was addressed with improved bounds checking.
Kernel	CVE-2026-112665	An app may be able to determine kernel memory layout	An information disclosure issue was addressed with improved state management.
Kernel	CVE-2026-112624	An app may be able to bypass Privacy preferences	This issue was addressed with improved checks.
libarchive	CVE-2026-112522	Processing a maliciously crafted file may lead to unexpected app termination	An out-of-bounds write issue was addressed with improved bounds checking.
LinkPresentation	CVE-2026-112621	Processing a maliciously crafted image may result in memory corruption	An out-of-bounds write issue was addressed with improved bounds checking.
Mail	CVE-2026-112500	The user’s original email address may be leaked when using the Hide My Email feature	A logic issue was addressed with improved restrictions.
Mail	CVE-2026-112671	A remote attacker may be able to cause a denial-of-service	A resource exhaustion issue was addressed with improved input validation.
Mail	CVE-2026-112414	Processing a maliciously crafted message may lead to a denial-of-service	A stack overflow was addressed with improved input validation.
Maps	CVE-2026-112707	An app may be able to identify what other apps a user has installed	A privacy issue was addressed by moving sensitive data to a protected location.
mDNSResponder	CVE-2026-112607	A remote attacker may be able to leak memory	An out-of-bounds read was addressed with improved bounds checking.
MediaAnalysis	CVE-2026-113915	An app may be able to access sensitive user data	A race condition was addressed with additional validation.
MediaRemote	CVE-2026-112687	An attacker on the local network may be able to cause unexpected system termination or corrupt process memory	This issue was addressed by removing the vulnerable code.
Messages	CVE-2026-112682	A remote attacker may be able to cause unexpected app termination	An input validation issue was addressed with improved input validation.
MobileGestalt	CVE-2026-86989	An app may be able to fingerprint the user	An authorization issue was addressed with improved state management.
Model I/O	CVE-2026-112565, CVE-2026-112449	Processing a maliciously crafted 3D model may lead to memory corruption	An integer overflow was addressed with improved input validation.
Model I/O	CVE-2026-112413	Processing a maliciously crafted file may lead to unexpected app termination	An out-of-bounds read was addressed with improved bounds checking.
Model I/O	CVE-2026-112485	Processing a maliciously crafted 3D model may lead to memory corruption	The issue was addressed with improved memory handling.
Model I/O	CVE-2026-112461	Processing a maliciously crafted 3D model may lead to memory corruption	An out-of-bounds write issue was addressed with improved bounds checking.
Model I/O	CVE-2026-112486	Processing a 3D model may lead to unexpected app termination	An out-of-bounds write issue was addressed with improved bounds checking.
Photos Storage	CVE-2026-65397	An app may be able to access sensitive user data	An authorization issue was addressed with improved state management.
Photos Storage	CVE-2026-112676	An app may be able to access a user’s Photos Library	This issue was addressed with additional entitlement checks.
Photos Storage	CVE-2026-112660	An app may be able to bypass certain Privacy preferences	An authorization issue was addressed with improved state management.
Power Management	CVE-2026-112681	An app may be able to fingerprint the user	This issue was addressed with additional entitlement checks.
Quick Look	CVE-2026-86925	An app may be able to access sensitive user data	An authorization issue was addressed with improved state management.
RealityKit	CVE-2026-112491	Processing a maliciously crafted file may lead to unexpected app termination	An out-of-bounds read was addressed with improved bounds checking.
ReplayKit	CVE-2026-112547	An app may be able to access sensitive user data	A type confusion issue was addressed with improved checks.
Safety Check	CVE-2026-112609	An app may be able to access sensitive user data	This issue was addressed with improved checks.
SceneKit	CVE-2026-112425	Processing a 3D model may result in disclosure of process memory	An out-of-bounds read was addressed with improved bounds checking.
SceneKit	CVE-2026-112423	Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents	An out-of-bounds read was addressed with improved bounds checking.
SceneKit	CVE-2026-112464	Processing a maliciously crafted file may lead to heap corruption	An out-of-bounds write issue was addressed with improved input validation.
SceneKit	CVE-2026-86991	Processing a maliciously crafted file may lead to unexpected process termination	A buffer overflow was addressed with improved bounds checking.
Screen Time	CVE-2026-112616	An app may be able to access sensitive user data	An authorization issue was addressed with improved access control.
Security	CVE-2026-113913	Processing web content may disclose sensitive information	An input validation issue was addressed with improved input validation.
Security	CVE-2026-112652	An malicious app may be able to bypass certificate validation	A logic issue was addressed with improved state management.
Shortcuts	CVE-2026-112559, CVE-2026-112455	An app may be able to access sensitive user data	An authorization issue was addressed with improved state management.
Siri	CVE-2026-112658	An app may be able to access sensitive user data	This issue was addressed with improved input validation.
Siri	CVE-2026-112685	An app may be able to access sensitive user data	An authorization issue was addressed with improved state management.
Spotlight	CVE-2022-26704	An app may be able to gain elevated privileges	A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.
Spotlight	CVE-2026-112567	A malicious application may be able to bypass Privacy preferences	This issue was addressed with improved checks.
Spotlight	CVE-2026-112628	An app may be able to access sensitive user data	This issue was addressed with improved data access restriction.
SpringBoard	CVE-2026-112646	An app may be able to cause unexpected system termination or corrupt process memory	An out-of-bounds write issue was addressed with improved bounds checking.
SwiftUI	CVE-2026-112691	An app may be able to cause unexpected system termination	An out-of-bounds write issue was addressed with improved input validation.
System Preferences	CVE-2026-86968	A malicious app may be able to access restricted system interfaces or launder launch attribution	An access issue was addressed with improved access control.
TextKit	CVE-2026-84605	An app may be able to read the device’s name	An authorization issue was addressed with improved state management.
Thread	CVE-2026-112595	An attacker in physical proximity may be able to craft malicious network traffic to gain access to a Thread network	This issue was addressed with improved authentication.
USB	CVE-2026-112479	A malicious USB device may be able to cause unexpected system termination or read kernel memory	An out-of-bounds read was addressed with improved bounds checking.
WebKit	CVE-2026-113904, CVE-2026-112599	Processing maliciously crafted web content may lead to an unexpected process crash	A use-after-free issue was addressed with improved memory management.
WebKit	CVE-2026-86974	Processing maliciously crafted web content may lead to memory corruption	A type confusion issue was addressed with improved checks.
WebKit	CVE-2026-86986, CVE-2026-112693	Processing maliciously crafted web content may lead to an unexpected Safari crash	A use-after-free issue was addressed with improved memory management.
WebKit	CVE-2026-86985	Processing maliciously crafted web content may lead to an unexpected process crash	This issue was addressed with improved input validation.
WebKit	CVE-2026-112699, CVE-2026-112680	Processing maliciously crafted web content may result in the disclosure of process memory	An out-of-bounds read was addressed with improved bounds checking.
WebKit	CVE-2026-112697, CVE-2026-112655, CVE-2026-112651, CVE-2026-112623	Processing maliciously crafted web content may lead to arbitrary code execution	A use-after-free issue was addressed with improved memory management.
WebKit	CVE-2026-112686	Processing maliciously crafted web content may lead to an unexpected process termination	A race condition was addressed with improved locking.
WebKit	CVE-2026-112684	Processing maliciously crafted web content may lead to an unexpected process crash	This issue was addressed through improved state management.
WebKit	CVE-2026-112673	Processing maliciously crafted web content may lead to an unexpected process termination	A type confusion issue was addressed with improved state handling.
WebKit	CVE-2026-112669	Processing maliciously crafted web content may lead to an unexpected Safari crash	A race condition was addressed with improved state handling.
WebKit	CVE-2026-112695, CVE-2026-112666, CVE-2026-112654, CVE-2026-112653, CVE-2026-112615	Processing maliciously crafted web content may lead to an unexpected process termination	A use-after-free issue was addressed with improved memory management.
WebKit	CVE-2026-112659	Processing maliciously crafted web content may lead to arbitrary code execution	A type confusion issue was addressed with improved memory handling.
WebKit	CVE-2026-112640	Processing maliciously crafted web content may lead to memory corruption	A use-after-free issue was addressed with improved memory management.
WebKit	CVE-2026-113952	A website may be able to use a media format that should be restricted in Lockdown Mode	A logic issue was addressed with improved checks.
WebKit	CVE-2026-113949	Processing maliciously crafted web content may lead to memory corruption	A type confusion issue was addressed with improved state management.
WebKit	CVE-2026-113903	Processing maliciously crafted web content may lead to unexpected memory modification	A use-after-free issue was addressed with improved memory management.
WebKit Canvas	CVE-2026-112637	Processing maliciously crafted web content may lead to arbitrary code execution	A use-after-free issue was addressed with improved memory management.
WebKit JavaScript Bindings	CVE-2026-112626	Processing maliciously crafted web content may lead to arbitrary code execution	A use-after-free issue was addressed with improved memory management.
WebKit Process Model	CVE-2026-113897	A remote attacker may be able to break out of Web Content sandbox	This issue was addressed by removing the vulnerable code.
WebKit Process Model	CVE-2026-112639	Processing maliciously crafted web content may lead to arbitrary code execution	A use-after-free issue was addressed with improved memory management.
WebRTC	CVE-2026-113901	Processing maliciously crafted web content may lead to an unexpected process crash	A use-after-free issue was addressed with improved memory management.
WebRTC	CVE-2026-86973	Processing maliciously crafted web content may lead to an unexpected process crash	An out-of-bounds read was addressed with improved bounds checking.
Wi-Fi	CVE-2026-113909	An attacker in physical proximity may be able to corrupt process memory	A memory corruption issue was addressed with improved input validation.
Wi-Fi	CVE-2026-112622	An attacker in radio range may be able to cause unexpected system termination	An out-of-bounds read was addressed with improved bounds checking.
Wi-Fi	CVE-2026-112620	An attacker in a privileged network position may be able to cause a denial-of-service	A denial-of-service issue was addressed with improved input validation.