Apple Fixes Two Kernel Vulnerabilities and One SceneKit Vulnerability I Reported in iOS/macOS 27.2
In security updates released on October 26, 2026, Apple credited me for three vulnerabilities I had previously reported. Two affected the Kernel, while the third affected SceneKit.
I’ll share more information about these issues after Apple confirms a few remaining details.
CVE-2026-112501 - Kernel
Apple lists me as the sole credited researcher for this CVE.
CVE-2026-112517 - Kernel
CVE-2026-86991 - SceneKit
Affected Releases
The two Kernel fixes were included in iOS 27.2 and iPadOS 27.2, iOS 26.7.2 and iPadOS 26.7.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, tvOS 27.2, watchOS 27.2, and visionOS 27.2.
The SceneKit fix was included in iOS, iPadOS, macOS, and visionOS releases listed above.