CVE-2026-113950

Received Received - Intake

Out-of-Bounds Write in Apple iOS and macOS

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Apple Inc.

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-26

Last Modified

2026-10-26

Generated

2026-10-27

AI Q&A

2026-10-27

EPSS Evaluated

N/A

NVD

CVE-2026-113950

EUVD

EUVD-2026-110336

Affected Vendors & Products

Vendor	Product	Version / Range
Apple	iOS and iPadOS	0
Apple	macOS	0
Apple	tvOS	0
Apple	visionOS	0
Apple	watchOS	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is an out-of-bounds write vulnerability caused by insufficient bounds checking when processing fonts. A maliciously crafted font file can trigger memory corruption, leading to unexpected app crashes or corrupt process memory.

Impact Analysis

If exploited, this flaw could allow attackers to crash apps or corrupt memory on your device. This might lead to data loss, instability, or potential execution of malicious code if combined with other vulnerabilities.

Mitigation Strategies

Update affected Apple devices to iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, or watchOS 27.2 or later to address the out-of-bounds write issue.

Hi! I’m here to help you understand CVE-2026-113950. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70