CVE-2026-113906 — Vulnerability intelligence

apple — ipados

Published: 2026-10-26T21:18:07.583

CVSS

6.5

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

A null pointer dereference was addressed with improved validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An attacker in physical proximity may be able to cause a denial-of-service.

Sources

• CVE-2026-113906
• Vendor Advisory
• Vendor Advisory