watchOS: 25 Vulnerabilities Disclosed Together, Ranging from Memory Corruption to Code Execution
Apple patched 25 vulnerabilities in watchOS and other operating systems on October 26, 2026, including memory corruption and arbitrary code execution risks.
Key findings
- Apple disclosed 25 vulnerabilities affecting watchOS and other operating systems on October 26, 2026.
- The batch includes memory corruption, buffer overflows, and use-after-free vulnerabilities.
- Potential impacts range from system termination and data disclosure to arbitrary code execution.
- All vulnerabilities were patched in watchOS 27 and watchOS 27.2.
- No vulnerabilities in this batch were reported as actively exploited in the wild.
On October 26, 2026, Apple Inc. disclosed a significant batch of 25 vulnerabilities affecting its watchOS operating system, alongside other platforms including iOS, iPadOS, macOS, tvOS, and visionOS. The vulnerabilities, all disclosed on the same day, range in severity and impact, with several allowing malicious applications to cause unexpected system termination, memory corruption, or unauthorized data access.
The disclosed vulnerabilities primarily fall into categories such as buffer overflows, use-after-free issues, out-of-bounds writes, and null pointer dereferences. These memory corruption vulnerabilities, if exploited, could lead to system instability or arbitrary code execution.
Specifically, CVE-2026-86972 describes a buffer overflow addressed by improved size validation, potentially leading to memory corruption when processing a maliciously crafted audio file. CVE-2026-86964 addresses a null pointer dereference with improved input validation, which could cause unexpected system termination. CVE-2026-84495 is a use-after-free issue resolved with better memory management, also potentially leading to system termination. CVE-2026-65385 involves an out-of-bounds write fixed by improved bounds checking, which may result in memory corruption and app termination. CVE-2026-113950, another out-of-bounds write, can lead to app termination or corrupt process memory when processing a crafted font.
Several vulnerabilities related to web content processing were also disclosed. CVE-2026-112697, a use-after-free issue in Safari, could lead to arbitrary code execution when processing maliciously crafted web content. Similarly, CVE-2026-112655, also a use-after-free in Safari, carries the risk of arbitrary code execution. Other web-related vulnerabilities include CVE-2026-112615, CVE-2026-112666, and CVE-2026-112640, which could lead to process termination or memory corruption.
Additionally, CVE-2026-112686, a race condition, and CVE-2026-112684, related to state management, could result in unexpected process termination when processing crafted web content. CVE-2026-112691, an out-of-bounds write, could also cause system termination. CVE-2026-112682, an input validation issue, could lead to app termination. CVE-2026-112560 and CVE-2026-112567 involve out-of-bounds reads and improved checks, respectively, potentially leading to memory disclosure or privacy bypass. CVE-2026-112619, an out-of-bounds write, could cause memory corruption when processing a crafted calendar invitation. CVE-2026-112606, a type confusion, and CVE-2026-112576, a memory integrity issue, could lead to unexpected system termination or changes. Finally, CVE-2026-112516, a use-after-free issue, could also result in unexpected system termination.
The batch also includes CVE-2026-113898, a logging issue addressed with improved data redaction, which could allow a malicious application to bypass privacy preferences.
All of these vulnerabilities were addressed in various updates across Apple's operating systems. For watchOS, the fixes are included in watchOS 27 and watchOS 27.2. Other affected systems include iOS, iPadOS, macOS (Golden Gate, Sequoia, Tahoe), tvOS, and visionOS, with specific version numbers detailed in the advisories. None of the vulnerabilities in this batch were reported as actively exploited in the wild, according to multiple security advisories.
This coordinated disclosure highlights the importance of timely patching for all Apple devices. Users are advised to update their watchOS devices to the latest available version to mitigate the risks associated with these vulnerabilities. The consistent release of such batches underscores the ongoing efforts by Apple to address security flaws across its ecosystem.