CVE-2026-112610: 
macOS vulnerability analysis and mitigation

CVE-2026-112610 is an out-of-bounds write vulnerability in Apple's CoreGraphics framework that can be triggered by processing a maliciously crafted PDF file, potentially leading to memory corruption. It affects iOS and iPadOS versions prior to 26.7.2 and 27.2, macOS Sequoia prior to 15.8.2, and macOS Tahoe prior to 26.7.2. The vulnerability was disclosed and patched on October 26, 2026. It was discovered by Meta Red Team X researcher Nik Tsytsarkin. The CVE status is currently "Awaiting Analysis" with a Feedly-estimated severity of HIGH and an EPSS score of 0.00228 (Apple Advisory iOS 26.7.2, Apple Advisory iOS 27.2, Apple Advisory macOS Tahoe, Apple Advisory macOS Sequoia).

The vulnerability is classified as an out-of-bounds write (CWE-787) in Apple's CoreGraphics framework, specifically in its PDF processing functionality. Insufficient bounds checking during PDF parsing allows memory to be written beyond the bounds of an allocated buffer, resulting in memory corruption. Exploitation requires no authentication — an attacker only needs to deliver a maliciously crafted PDF file to a target user and have it processed by the affected system (e.g., via a preview, email attachment, or web download). No public proof-of-concept code has been identified at this time (Apple Advisory iOS 26.7.2, Apple Advisory macOS Sequoia).

Successful exploitation of CVE-2026-112610 can lead to memory corruption on affected Apple devices, which may result in unexpected application termination or, in more severe scenarios, arbitrary code execution in the context of the application processing the PDF. The vulnerability affects a broad range of Apple hardware including iPhone 11 and later, multiple iPad generations, macOS Sequoia, and macOS Tahoe systems. While the immediate impact is memory corruption, chained with other vulnerabilities, this class of flaw could potentially be leveraged for privilege escalation or further compromise of the affected device (Apple Advisory iOS 26.7.2, Apple Advisory macOS Tahoe).

As of the time of disclosure, there is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept for CVE-2026-112610. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.00228 (approximately 0.23%), indicating a low probability of exploitation in the near term. No threat actor attribution has been reported (Feedly).

1. Craft a malicious PDF: Create a specially crafted PDF file that triggers the out-of-bounds write condition in Apple's CoreGraphics PDF parsing code by manipulating PDF structures to cause improper bounds calculations.
2. Deliver the payload: Distribute the malicious PDF to the target via email attachment, a malicious website, AirDrop, iMessage, or any other file-sharing mechanism that would cause the file to be opened or previewed on an affected Apple device.
3. Trigger processing: The victim opens or previews the PDF using any application that invokes CoreGraphics for rendering (e.g., Preview, Safari, Mail, Files app), causing the vulnerable code path to execute.
4. Achieve memory corruption: The out-of-bounds write corrupts adjacent memory, potentially leading to application crash or, if exploited precisely, arbitrary code execution in the context of the processing application.
5. Chain for further impact (advanced): Combine with a privilege escalation vulnerability to move from user-level code execution to higher privileges on the device (Apple Advisory iOS 26.7.2, Apple Advisory macOS Sequoia).

• Logs: Unexpected application crashes or crash reports (in /Library/Logs/DiagnosticReports/ on macOS or via Settings > Privacy & Security > Analytics on iOS) involving CoreGraphics or PDF-rendering processes after opening a PDF file.
• File System: Presence of unexpected or unsolicited PDF files in Downloads, Mail attachments, or temporary directories that were recently accessed.
• Process: Unusual child processes spawned by PDF-rendering applications (e.g., Preview, Safari, Mail) immediately after opening a PDF; repeated application crashes tied to a specific PDF file.
• Network: Outbound network connections from PDF-rendering applications to unknown external hosts shortly after a PDF is opened, which may indicate a successful exploit attempting to establish a callback.

Apple has released patches addressing CVE-2026-112610 in the following updates released on October 26, 2026: iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. Users should update their devices immediately via Settings > General > Software Update (iOS/iPadOS) or System Settings > General > Software Update (macOS). As a temporary workaround until patching is possible, users should avoid opening PDF files from untrusted or unknown sources (Apple Advisory iOS 26.7.2, Apple Advisory macOS Sequoia).

The SANS Internet Storm Center published a diary entry covering Apple's October 2026 patch batch, which included CVE-2026-112610 among numerous other fixes (SANS ISC Diary). CIS Security issued an advisory noting that multiple vulnerabilities in Apple products could allow for arbitrary code execution (CIS Advisory). Coverage from CyberSecurityNews and Cryptika highlighted the broader iOS 27.2 release, which addressed 163 vulnerabilities including this one (CyberSecurityNews). The vulnerability was reported by Meta Red Team X researcher Nik Tsytsarkin, who was credited across multiple CVEs in the same release cycle.