Apple tvOS: 25 Vulnerabilities Disclosed Together, Patched in tvOS 27.2
Key findings • 25 vulnerabilities disclosed simultaneously for Apple tvOS and other Apple operating systems on October 26, 2026. • Flaws include memory corruption, use-after-free, buffer over…
Key findings
- 25 vulnerabilities disclosed simultaneously for Apple tvOS and other Apple operating systems on October 26, 2026.
- Flaws include memory corruption, use-after-free, buffer overflows, and access control issues.
- Potential impacts range from system termination and data disclosure to arbitrary code execution.
- All vulnerabilities were patched in tvOS 27.2 and corresponding updates for other Apple platforms.
- No vulnerabilities in this batch were reported as actively exploited in the wild.
On October 26, 2026, Apple Inc. disclosed a significant batch of 25 vulnerabilities affecting its tvOS operating system, alongside numerous other Apple platforms including iOS, iPadOS, macOS, and watchOS. The vulnerabilities, all disclosed on the same day, range in severity and impact, with several allowing malicious applications to access sensitive user data, cause system termination, or even achieve arbitrary code execution. This coordinated disclosure event highlights a broad range of memory management and input validation flaws across Apple's ecosystem.
Several vulnerabilities stem from memory corruption issues. CVE-2026-86972 describes a buffer overflow that could occur when processing a maliciously crafted audio file, leading to memory corruption. Similarly, CVE-2026-113950 involves an out-of-bounds write when processing a font file, potentially leading to unexpected app termination or corrupt process memory. Other memory-related flaws include use-after-free vulnerabilities, such as CVE-2026-112655, which could lead to arbitrary code execution when processing maliciously crafted web content. CVE-2026-112640 also details a use-after-free issue in web content processing that could result in memory corruption. CVE-2026-84495 and CVE-2026-112697 are also use-after-free vulnerabilities that could lead to system termination or, in the case of CVE-2026-112697, arbitrary code execution. CVE-2026-112687, fixed by removing vulnerable code, could allow a local network attacker to cause system termination or corrupt process memory.
Other vulnerabilities focus on access control and data handling. CVE-2026-86978 and CVE-2026-112692 indicate issues where apps may be able to access sensitive user data, addressed by improved checks and entitlement checks, respectively. CVE-2026-112706 is another permission issue allowing sensitive data access. CVE-2026-113898 involves a logging issue where a malicious application could bypass privacy preferences, fixed by improved data redaction.
Several vulnerabilities could lead to system instability or denial of service. CVE-2026-86964 describes a null pointer dereference that could cause unexpected system termination. CVE-2026-112642 and CVE-2026-112656 are out-of-bounds read issues in font processing that could lead to disclosure of process memory. CVE-2026-112638 is a heap buffer overflow that could cause system termination, and CVE-2026-112620 is a denial-of-service vulnerability exploitable by an attacker in a privileged network position. CVE-2026-112615, a use-after-free in web content processing, could lead to unexpected process termination.
The batch also includes vulnerabilities related to media and web content processing. CVE-2026-113912 involves an out-of-bounds access when processing media files, potentially leading to app termination. CVE-2026-112686, a race condition in web content processing, could lead to unexpected process termination. CVE-2026-112684 and CVE-2026-112666 are also use-after-free issues related to web content processing, potentially leading to unexpected process crashes or termination. CVE-2026-112689 is an out-of-bounds write in input validation that could corrupt kernel memory.
According to related news coverage, none of the vulnerabilities in this batch were reported as actively exploited in the wild. The fixes were released across multiple versions of Apple's operating systems, including tvOS 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, and others. For tvOS users, the specific version addressing these issues is tvOS 27.2.
This coordinated disclosure of 25 vulnerabilities underscores the importance of timely patching for all Apple devices. Users of tvOS and other affected Apple products should ensure their systems are updated to the latest versions to mitigate the risks associated with these memory corruption, data access, and system stability flaws. The broad range of affected components suggests a need for vigilance in software updates across the Apple ecosystem.