apple ios CVE-2026-112612 vulnerability in Apple Products
Published on October 26, 2026

product logo product logo product logo
A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files.

NVD

Vulnerability Analysis

CVE-2026-112612 is exploitable with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Type

What is a Directory traversal Vulnerability?

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVE-2026-112612 has been classified to as a Directory traversal vulnerability or weakness.


Products Associated with CVE-2026-112612

Want to know whenever a new CVE is published for Apple products? stack.watch will email you.

Apple iOS
 
Apple iPadOS
 
Apple Ios And Ipados
 

Affected Versions

Apple iOS and iPadOS: