CVE-2026-113906
published 2026-10-26CVE-2026-113906: A null pointer dereference was addressed with improved validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An attacker…
PriorityP427high7.8
EPSS
0.15%
4.6th percentile
A null pointer dereference was addressed with improved validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An attacker in physical proximity may be able to cause a denial-of-service.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_and_ipados | < 26.7.2 | 26.7.2 |
| apple | ios_and_ipados | < 27.2 | 27.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apple iOS/iPadOS up to 26.7.1/27.1 null pointer dereference
vuldb·2026-10-26
CVE-2026-113906 [LOW] Apple iOS/iPadOS up to 26.7.1/27.1 null pointer dereference
A vulnerability described as problematic has been identified in Apple iOS and iPadOS up to 26.7.1/27.1. Affected is an unknown function. The manipulation results in null pointer dereference.
This vulnerability is reported as CVE-2026-113906. The attack requires a local approach. No exploit exists.
Upgrading the affected component is recommended.
GHSA
A null pointer dereference was addressed with improved validation.
ghsa_unreviewed·2026-10-26
CVE-2026-113906 A null pointer dereference was addressed with improved validation.
A null pointer dereference was addressed with improved validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An attacker in physical proximity may be able to cause a denial-of-service.
No detection rules found.
No public exploits indexed.
2026-10-26
Published