CVE-2026-112611: 
macOS vulnerability analysis and mitigation

CVE-2026-112611 is an out-of-bounds write vulnerability in Apple's CoreGraphics framework, triggered when processing a maliciously crafted PDF file, which may lead to memory corruption. It affects iOS and iPadOS prior to versions 26.7.2 and 27.2, as well as macOS Sequoia prior to 15.8.2 and macOS Tahoe prior to 26.7.2. Apple disclosed and patched the vulnerability on October 26, 2026 (Apple iOS 26.7.2, Apple iOS 27.2, Apple macOS Tahoe, Apple macOS Sequoia). The CVE status is currently "Awaiting Analysis" and Feedly estimates the severity as Medium; an EPSS score of 0.0023 has been assigned (Feedly).

The vulnerability is classified as an out-of-bounds write (CWE-787) in Apple's CoreGraphics PDF rendering engine, addressed by improved bounds checking. Based on the public proof-of-concept, two distinct code paths can trigger the flaw: (1) an embedded CMap within a Type0 font object containing an oversized codespace range, and (2) a Type-5 shading dictionary with a Function whose Range dimension count mismatches the color-component count (e.g., 136 dimensions for a DeviceGray colorspace). Both paths cause the CoreGraphics renderer to write beyond allocated buffer boundaries when parsing the malformed PDF structures. Exploitation requires user interaction — specifically, a victim must open or render the crafted PDF through a CoreGraphics-based application (Apple iOS 27.2, PoC GitHub).

Successful exploitation can lead to memory corruption in the process rendering the malicious PDF, with potential consequences ranging from application crash (denial of service) to arbitrary code execution in the context of the affected process. The vulnerability is reachable without authentication — any user who opens a crafted PDF via Mail, Safari, Files, or any CoreGraphics-backed viewer is at risk. While the public PoC currently demonstrates only crash-level impact (EXC_BAD_ACCESS with attacker-controlled fault addresses), the underlying out-of-bounds write primitive could theoretically be developed into a full code execution exploit (Apple iOS 26.7.2, PoC GitHub).

A public proof-of-concept is available on GitHub (published October 27, 2026), consisting of Python scripts that generate malformed PDFs triggering deterministic EXC_BAD_ACCESS crashes with attacker-chosen double values; on-device crash fingerprints confirm attacker value control over the fault address (PoC GitHub). The PoC demonstrates denial-of-service impact only and does not include a code execution payload. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.0023 (approximately 0.23%), indicating a currently low probability of exploitation in the wild (Feedly). The vulnerability was credited to multiple researchers including f4 & Zhiniang Peng (HUST), Aobo Wang, Xiang Chen, Jakob Pammer, Anna Groza of Calif.io, Piotr Jerzy Duszynski, and an anonymous researcher (Apple iOS 27.2).

1. Craft a malicious PDF: Use the public PoC scripts (make_poc_shading.py or make_poc_cmap.py) to generate a malformed PDF. For the shading variant, make_shading_pdf(136, ...) builds a ShadingType 5 dictionary with ColorSpace DeviceGray and a Function whose Range has 136 dimensions, creating a mismatch that triggers the OOB write. For the CMap variant, cmap_body() writes an oversized codespace range (8, 32, or 128 bytes) embedded in a Type0 font object.
2. Select a delivery mechanism: Deliver the crafted PDF to the target via email attachment, web download, AirDrop, iMessage, or any other channel that causes the victim's device to render the file through CoreGraphics (e.g., Mail preview, Safari PDF viewer, Files app).
3. Induce victim interaction: Convince the target to open or preview the PDF file. No authentication or elevated privileges are required on the attacker's side; only user interaction (opening the file) is needed.
4. Trigger the out-of-bounds write: Upon rendering, CoreGraphics processes the malformed shading or CMap structure without adequate bounds checking, writing beyond the allocated buffer. This results in an EXC_BAD_ACCESS crash with attacker-influenced fault addresses (e.g., 0x3ff000000000001c matching a PDF-selected double value of 1.0).
5. Collect crash telemetry (PoC only): Use tools/ips_parse.py to extract exception type, faulting thread, and unslid frame addresses from .ips crash report files to verify exploitation and assess value control (PoC GitHub).

• File System: Presence of unexpected or unsolicited PDF files in Downloads, Mail attachments, or temporary directories; PDF files with anomalous internal structures (oversized CMap codespace ranges or Type-5 shading Function Range mismatches detectable via PDF analysis tools.
• Logs: Crash reports (.ips files) in /Library/Logs/DiagnosticReports/ or ~/Library/Logs/DiagnosticReports/ referencing EXC_BAD_ACCESS in CoreGraphics-related processes (e.g., com.apple.CoreGraphics, PDFKit, QuickLookUIService, MobileSafari).
• Process: Unexpected termination of PDF-rendering processes (e.g., QuickLookSatellite, WebContent, MobileSafari) shortly after opening a PDF file; repeated crashes of the same process triggered by the same document.
• Network: Unusual inbound delivery of PDF files from unknown or untrusted sources via email, web, or messaging channels, particularly if followed by application crashes (PoC GitHub, Apple iOS 26.7.2).

Apple has released patches addressing CVE-2026-112611 in the following updates, all released October 26, 2026: iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2 (Apple iOS 26.7.2, Apple iOS 27.2, Apple macOS Tahoe, Apple macOS Sequoia). Users should update their devices to the patched versions immediately via Settings > General > Software Update (iOS/iPadOS) or System Settings > General > Software Update (macOS). As a temporary workaround where patching is not immediately possible, restrict opening PDF files from untrusted or unknown sources, disable automatic PDF previews in Mail and messaging apps, and implement file type validation and sandboxing for PDF processing operations.

The SANS Internet Storm Center published a diary entry covering Apple's October 2026 patch batch, which included CVE-2026-112611 among numerous CoreGraphics and other fixes (SANS ISC). CIS Security issued an advisory noting that multiple vulnerabilities in Apple products, including this one, could allow for arbitrary code execution (CIS Advisory). Security news outlets including CyberSecurityNews and Cryptika covered the iOS 27.2 release, highlighting the breadth of the patch batch (163+ vulnerabilities) and the inclusion of critical WebKit and CoreGraphics fixes (CyberSecurityNews). The vulnerability was also discussed on Full Disclosure mailing lists shortly after disclosure (Full Disclosure).