Download JSON

About the security content of tvOS 27.2

This document describes the security content of tvOS 27.2.

About Apple security updates

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.

Apple security documents reference vulnerabilities by CVE-ID when possible.

For more information about security, see the Apple Product Security page.

tvOS 27.2

Accounts

Available for: Apple TV 4K 2nd generation and later

Impact: A malicious application may be able to bypass Privacy preferences

Description: A logging issue was addressed with improved data redaction.

CVE-2026-113898: Bhaswanth Chigurupati

Accounts

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to access sensitive user data

Description: This issue was addressed with additional entitlement checks.

CVE-2026-112446: LiangWei, Sindre Sorhus

App Intents

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to access sensitive user data

Description: This issue was addressed with additional entitlement checks.

CVE-2026-112692: Huy Nguyen (@34306) of Calif.io

AppleAVD

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted video file may lead to unexpected app termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-112416: an anonymous researcher, Dohyeon An @PILAB Technology, Inc, Hcamael and 章鱼哥@aipy (aipyaipy.com), Narendra Singh (@_3P1C), Meta Red Team X - Nik Tsytsarkin

AppleAVD

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory

Description: The issue was addressed with improved memory handling.

CVE-2026-112454: @Licht_jb, Hcamael and 章鱼哥@aipy (aipyaipy.com)

Audio

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted file may lead to unexpected app termination

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-112546: lunar815, Surej Sekhar, Piotr Jerzy Duszynski, r3pwnx (@r3pwnx), an anonymous researcher, Lily Cohl (@GenericCoding), Nathaniel Oh (@calysteon)

AVEVideoEncoder

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to cause unexpected system termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-112705: Marco Schmitt, Andrey Chernykh, Josh Maine of Calif.io

AVEVideoEncoder

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to cause unexpected system termination or corrupt kernel memory

Description: An out-of-bounds write issue was addressed with improved input validation.

CVE-2026-112689: Franco Belman at Blackwing Intelligence

AVEVideoEncoder

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to cause unexpected system termination or corrupt kernel memory

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-112470: Hcamael and 章鱼哥@aipy (aipyaipy.com)

CVE-2026-112469: Hcamael and 章鱼哥@aipy (aipyaipy.com)

CVE-2026-112468: Hcamael and 章鱼哥@aipy (aipyaipy.com)

AVEVideoEncoder

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to cause unexpected system termination or read kernel memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2026-112466: Hcamael and 章鱼哥@aipy (aipyaipy.com)

Bluetooth

Available for: Apple TV 4K 2nd generation and later

Impact: An attacker in physical proximity may be able to cause a denial-of-service

Description: A null pointer dereference was addressed with improved validation.

CVE-2026-112566: Chris Bailey - Short Circuit

ColorSync

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted image may result in disclosure of process memory

Description: The issue was addressed with improved checks.

CVE-2026-86988: Mateusz Jurczyk of Google Project Zero, Meta Red Team X - Nik Tsytsarkin

Compression

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to disclose kernel memory

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2026-113910: Tucker Willenborg

CoreAudio

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory

Description: An out-of-bounds access issue was addressed with improved bounds checking.

CVE-2026-113912: an anonymous researcher, 章鱼哥@aipy (aipyaipy.com), Roman Zabicki, Anna Groza (@pwnlambda) of Calif.io

CoreAudio

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to cause unexpected system termination or corrupt process memory

Description: A buffer overflow issue was addressed with improved memory handling.

CVE-2026-113907: Meta Red Team X - Nik Tsytsarkin

CoreAudio

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted audio file may lead to memory corruption

Description: A buffer overflow was addressed with improved size validation.

CVE-2026-86972: an anonymous researcher, Meta Product Security

CoreAudio

Available for: Apple TV 4K 2nd generation and later

Impact: An attacker in radio range may be able to cause unexpected system termination

Description: A heap buffer overflow was addressed with improved bounds checking.

CVE-2026-112638: Përparim Mjeku, Altin Gashi, Altin Gashi

CoreGraphics

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-113950: Substrate, Stefan Esser (Calif)

CoreMedia

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted video file may lead to unexpected app termination

Description: The issue was addressed with improved memory handling.

CVE-2026-86992: Niels Hofmans

CoreMedia

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to access sensitive user data

Description: A permissions issue was addressed with additional restrictions.

CVE-2026-112706: Adriatik Raci, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Chris Bailey - Short Circuit

CoreText

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted font may result in the disclosure of process memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-112656: Nurihan Kim (HanTul) working with TrendAI Zero Day Initiative

FontParser

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted font may result in the disclosure of process memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2026-86970: Hcamael and 章鱼哥@aipy (aipyaipy.com)

FontParser

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted font may result in the disclosure of process memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-112642: Meta Red Team X - Nik Tsytsarkin

FontParser

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to access sensitive user data

Description: A logging issue was addressed with improved data redaction.

CVE-2026-112432: D4rthL

Heimdal

Available for: Apple TV 4K 2nd generation and later

Impact: An attacker in a privileged network position may be able to impersonate a Kerberos KDC

Description: An issue with signature validation was addressed with improved checks.

CVE-2026-112518: Roman Zabicki, Tristan Madani (@TristanInSec) from Talence Security

HomeKit

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to access sensitive user data

Description: This issue was addressed with improved checks.

CVE-2026-86978: Garin R

HomeKit

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted video file may lead to unexpected system termination

Description: An integer overflow was addressed with improved bounds checking.

CVE-2026-112596: Garin R

ImageIO

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted image may result in disclosure of process memory

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2026-112571: sh3rlock (김보겸)

ImageIO

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted image may result in disclosure of process memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-112561: Meta Red Team X - Nik Tsytsarkin

CVE-2026-112560: Wout van der Ploeg (woutvanderploeg.nl)

IOHIDFamily

Available for: Apple TV 4K 2nd generation and later

Impact: An attacker may be able to cause unexpected system termination or read kernel memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-112515: Charles Stevenson, Seung Je Seong, Mathis Mansière

IOMobileFrameBuffer

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to cause unexpected system termination or corrupt kernel memory

Description: A race condition was addressed with improved state handling.

CVE-2026-112459: Lily Cohl (@GenericCoding), an anonymous researcher

IOSurface

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to cause unexpected system termination or corrupt kernel memory

Description: A race condition was addressed with improved locking.

CVE-2026-112477: an anonymous researcher

Kernel

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to cause unexpected changes to copy-on-write memory

Description: A memory integrity issue was addressed with improved handling of copy-on-write pages.

CVE-2026-112576: Pedro Pinho

Kernel

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to cause unexpected system termination

Description: A type confusion issue was addressed with improved memory handling.

CVE-2026-112606: Wang Yu

Kernel

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to cause unexpected system termination or corrupt kernel memory

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-65350: Nebula Security (@nebusecurity), Tim Michaud (@TimGMichaud) of Aginor.ai, Xinru Chi of Pangu Lab

CVE-2026-112679: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Kernel

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to cause unexpected system termination or corrupt kernel memory

Description: A use after free issue was addressed with improved memory management.

CVE-2026-112517: Pasquale Scola, Wout van der Ploeg (woutvanderploeg.nl), John Lussier, Cem Onat Karagun, an anonymous researcher

Kernel

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to cause unexpected system termination

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-112516: greenbynox, an anonymous researcher

Kernel

Available for: Apple TV 4K 2nd generation and later

Impact: An attacker may be able to cause unexpected system termination or corrupt kernel memory

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-112514: Marc Newlin of SkySafe, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., greenbynox

Kernel

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to cause unexpected system termination or write kernel memory

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-84495: Wang Yu

CVE-2026-112474: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Kernel

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to cause unexpected system termination

Description: A race condition was addressed with improved state handling.

CVE-2026-112501: Cem Onat Karagun

Kernel

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to cause unexpected system termination

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-112476: Arnold Cartagena, Matt Suiche (@msuiche) of Tolmo

Kernel

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to determine kernel memory layout

Description: An information disclosure issue was addressed with improved state management.

CVE-2026-112665: Will Estes

MediaAnalysis

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to access sensitive user data

Description: A race condition was addressed with additional validation.

CVE-2026-113915: Abodi Dawoud, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Zhongquan Li (@Guluisacat), Ilya Andr (andrd3v) of Positive Technologies

MediaRemote

Available for: Apple TV 4K 2nd generation and later

Impact: An attacker on the local network may be able to cause unexpected system termination or corrupt process memory

Description: This issue was addressed by removing the vulnerable code.

CVE-2026-112687: Azize Rhounam, Rahul Raj

Model I/O

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted file may lead to unexpected app termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2026-112563: stratan (@5tratan)

Model I/O

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted 3D model may lead to memory corruption

Description: The issue was addressed with improved memory handling.

CVE-2026-112485: Nik Tsytsarkin

RealityKit

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted file may lead to unexpected app termination

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-112491: Hongsik Kim (mnur)

SceneKit

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a 3D model may result in disclosure of process memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2026-112425: stratan (@5tratan)

SceneKit

Available for: Apple TV 4K 2nd generation and later

Impact: Processing a maliciously crafted file may lead to heap corruption

Description: An out-of-bounds write issue was addressed with improved input validation.

CVE-2026-112464: 정우 하 (@0xfa11babe), Narendra Singh (@_3P1C)

Shortcuts

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to access sensitive user data

Description: An authorization issue was addressed with improved state management.

CVE-2026-112455: Chris Bailey - Short Circuit, Rahul Raj

Siri

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to access sensitive user data

Description: An authorization issue was addressed with improved state management.

CVE-2026-112685: silo, Abodi Dawoud

Spotlight

Available for: Apple TV 4K 2nd generation and later

Impact: A malicious application may be able to bypass Privacy preferences

Description: This issue was addressed with improved checks.

CVE-2026-112567: zenith

Thread

Available for: Apple TV 4K 2nd generation and later

Impact: An attacker in physical proximity may be able to craft malicious network traffic to gain access to a Thread network

Description: This issue was addressed with improved authentication.

CVE-2026-112595: Wesley Wineberg

WebKit

Available for: Apple TV 4K 2nd generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-113904: Lily Cohl (@GenericCoding), Do Young Park (adawn), MYUNGYONG LEE, Luke Francis (@lukefr09), Shubham Chaskar, Kwak Kiyong, Song Nuri

CVE-2026-112599: Avinash Kumar Thapa & Jay Kaushik Patel

WebKit

Available for: Apple TV 4K 2nd generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: This issue was addressed with improved input validation.

CVE-2026-86985: Pasquale Scola

WebKit

Available for: Apple TV 4K 2nd generation and later

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-112697: OpenAI Codex Security - Amy Burnett, 은태 장

CVE-2026-112655: Euntae Jang

WebKit

Available for: Apple TV 4K 2nd generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process termination

Description: A race condition was addressed with improved locking.

CVE-2026-112686: an anonymous researcher

WebKit

Available for: Apple TV 4K 2nd generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: This issue was addressed through improved state management.

CVE-2026-112684: Gia Bui (@yabeow) from Calif.io

WebKit

Available for: Apple TV 4K 2nd generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description: A race condition was addressed with improved state handling.

CVE-2026-112669: remanone (@remanone_)

WebKit

Available for: Apple TV 4K 2nd generation and later

Impact: Processing maliciously crafted web content may lead to an unexpected process termination

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-112666: Luke Francis (@lukefr09)

CVE-2026-112615: Chris Rohlf with Anthropic Research

WebKit

Available for: Apple TV 4K 2nd generation and later

Impact: Processing maliciously crafted web content may lead to memory corruption

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-112640: an anonymous researcher

WebKit Canvas

Available for: Apple TV 4K 2nd generation and later

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-112637: Chris Rohlf with Anthropic Research, 은태 장

WebKit JavaScript Bindings

Available for: Apple TV 4K 2nd generation and later

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-112626: Euntae Jang, Luke Francis (@lukefr09), Shubham Chaskar, Josef Korbel (Citadelo)

Wi-Fi

Available for: Apple TV 4K 2nd generation and later

Impact: An attacker in a privileged network position may be able to cause a denial-of-service

Description: A denial-of-service issue was addressed with improved input validation.

CVE-2026-112620: Nathaniel Oh (@calysteon)

Additional recognition

Audio

We would like to acknowledge Nathaniel Oh (@calysteon) for their assistance.

AVEVideoEncoder

We would like to acknowledge Josh Maine of Calif.io, Narendra Singh (@_3P1C) for their assistance.

CoreAudio

We would like to acknowledge Meta Product Security for their assistance.

CoreCrypto

We would like to acknowledge Niels Hofmans for their assistance.

Foundation

We would like to acknowledge Jaya Surya Kommireddy for their assistance.

Kernel

We would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Tristan Madani (@TristanInSec) from Talence Security for their assistance.

libarchive

We would like to acknowledge Muhammad Abdul Rehman, Owais Lone for their assistance.

mDNSResponder

We would like to acknowledge Aswin Kumar Gokula Kannan, Lucas Lammer, pixillated for their assistance.

Sandbox Profiles

We would like to acknowledge Ilya Andr (andrd3v) of Positive Technologies for their assistance.

WebKit

We would like to acknowledge Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Stan Shaw, Volodymyr Diachenko, Wael Alolowi for their assistance.