Out-of-Bounds Read in macOS CoreText (CVE‑2026‑112656) Enables Information Disclosure
What It Is — Apple’s macOS CoreText library contains an out‑of‑bounds read in the parsing of ligature caret lists (GDEF LigCaretList). An attacker who convinces a user to open a malicious file or visit a crafted web page can trigger the flaw, causing the process to read memory beyond the allocated buffer. The read‑out may expose fragments of the victim’s memory, and, when chained with other vulnerabilities, could lead to code execution in the current process context. The issue is tracked as CVE‑2026‑112656, carries a CVSS 3.3 (Low) score, and was publicly disclosed on 28 Oct 2026. Apple released a security update that corrects the parsing logic.
Affected Products — Apple macOS (all versions prior to the October 2026 security update).
Why It Matters for Trust & Control Assurance — The flaw tests the control objective of secure software lifecycle management, specifically the need for timely patching and verification of operating‑system components.
Recommended Actions —
- Deploy Apple’s October 2026 macOS security update to all endpoints immediately.
- Verify patch deployment via inventory tools and record remediation evidence for audit purposes.
- Incorporate the vulnerability into your continuous monitoring program to ensure future OS patches are applied promptly.
Source: Zero Day Initiative advisory