Seven Apple CVEs, two Bluetooth credits, and the bugs behind them

Apple’s October 26 security updates credit me, Chris Bailey of Short Circuit, in seven new CVEs. Two are Bluetooth vulnerabilities, and both list me as the only publicly credited researcher. I’m proud of that. Credits in a release spanning several Apple platforms are a good reason to stop staring at a crash report for a minute.

The entries cover Bluetooth, CoreMedia, Screen Time, Shortcuts and Spotlight. All seven appear in the iOS 27.2 and iPadOS 27.2 advisory; several also appear in updates for Macs, watches, Apple TVs, Vision Pro and earlier supported iPhone and iPad releases. These are seven distinct CVE identifiers. I’m not counting them again every time Apple puts the same identifier in another release note.

Apple’s iOS 27.2 and iPadOS 27.2 security advisory

Several of these bugs came with reassuring signs: a rejected request, a warning in a log, an app whose privacy permission remained ungranted. The tests showed why those signs were not enough. Recorded browsing addresses came back, a local music file reached an unauthorized app, and video metadata altered working state in a system service. The individual articles below follow those results back to the decisions that failed.

Bluetooth found the problem. Then it used the result anyway.

The Bluetooth failure is a particularly irritating sort of bug because the validation was already there. The code could recognize that a channel was unsuitable for the operation and return no usable object. Its caller then tried to use that absent object. A successful rejection became a service crash in the very next part of the handling.

That is more specific than saying somebody forgot to validate the input. The software asked the question, got a failure back and failed to handle it. The detailed articles explain how the controls separate a missing channel from an existing channel of the wrong kind, and why that distinction matters when deciding what actually caused a crash.

CVE-2026-112566 — the validation failure and the broader Apple release coverage

CVE-2026-113906 — the mobile crash evidence, connection conditions and iPhone/iPad fixes

Apple describes both entries as a nearby denial of service. My Mac test used a helper app to accept incoming connections; the iPad tests used active discovery. Neither required an existing trusted pairing. Those conditions matter: the device had to accept a connection before the faulty processing became relevant. The individual articles separate that tested reachability from Apple's broader lists of fixed products.

Both entries credit Chris Bailey - Short Circuit alone. My submissions documented related channel-handling failures and Bluetooth service crashes. They did not demonstrate access to private messages or control of the device.

Two CoreMedia bugs, with very different receipts

CoreMedia helps the operating system handle media. That covers a lot of work, so two findings under the same component name need not have much in common. In one of my submissions, malformed video metadata damaged memory. In the other, perfectly readable media went to an app that should not have been able to read it.

CVE-2026-112688: the parser that noticed and carried on

The video metadata declared more records than the parser’s working storage could safely hold. A check recognized the excessive count, but processing continued. The resulting overwrite could damage another count that later work relied on, making the initial mistake affect the next operation too. Logging the problem was not doing much for the memory being overwritten.

My evidence included controlled corruption and a crash in a separate display service, with a conforming video as a comparison. The captured iPhone playback runs used an enabled display-processing path; the article explains that test condition as well. Apple lists possible arbitrary code execution among the impacts; I did not demonstrate that. The article follows the damaged bookkeeping and explains why the location of the parsing mattered.

Read the CoreMedia video-metadata research

Apple credits 정우 하 (@0xfa11babe) and Chris Bailey - Short Circuit.

CVE-2026-112706: the helper skipped the caller’s permission check

The media-library finding had a much less dramatic-looking outcome: my app received a music file. The relevant detail is that it had never been granted Media & Apple Music permission. The returned bytes matched the original, so this was actual content rather than a title, a success message or an empty result dressed up as evidence.

The trusted helper could open the file for its own work. The affected route failed to check whether the app asking for it was allowed to receive it. Other operations still enforced restrictions, which helped pin down the discrepancy. The full article explains that comparison and the read-only, local-media scope.

Read the CoreMedia media-library permissions research

Apple credits Adriatik Raci; Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova; and Chris Bailey - Short Circuit.

Personal data had some less obvious ways out

The remaining three findings concern services behind features people recognize immediately. Screen Time records activity, Shortcuts prepares actions involving other apps, and Spotlight keeps an index so searching does not take forever. Those jobs require access to information. The bugs were in deciding which other app should get an answer.

Screen Time — CVE-2026-112616

The ordinary route refused my app access to recorded Safari addresses. The service holding those records returned them without enforcing the corresponding caller restriction. A check inside the app making the request cannot do the whole job of protecting a service from that app. The article explains the comparison, the test without debugging privileges, and why a URL can reveal considerably more than a website’s name.

Read the Screen Time research

Apple credits Drin Raci of sentry.security; Chris Bailey - Short Circuit; Mustafa Calap (@ordinal0, dbg.re); Robert Mindo; N.M.Praveen Nawarathne (@zblockrat); Ilya Andr (andrd3v); and Sindre Sorhus.

Shortcuts — CVE-2026-112455

This one disclosed information while preparing an action. A helper resolving the possible items for that action returned private message and note text without making the permission decision for the requesting app. There was no need for the final action to finish before information had already crossed the boundary. Calling something preparation does not make the returned text any less private.

Read the Shortcuts research

Apple credits Chris Bailey - Short Circuit and Rahul Raj.

Spotlight — CVE-2026-112628

Spotlight initially restricted the search correctly, then allowed later processing to widen it without an equivalent authorization check. The final search could return indexed information outside my app’s own scope. The full article also covers a problem with my early test baseline and the stronger controls that replaced it. Finding a bug in the test does not make the suspected bug disappear; it means the test needs fixing before the conclusion deserves anyone’s trust.

Read the Spotlight research

Apple credits Santiago Albertengo and Chris Bailey - Short Circuit.

Credit where it belongs, and updates where they are needed

Thank you to Apple’s security and engineering teams for addressing these issues and acknowledging the research. I appreciate the work involved in getting corrections into several supported release branches. I also want to thank the researchers named alongside me. These are shared public credits, and describing my own submissions does not make anyone else’s contribution vanish.

These credits follow the Apple findings I wrote about in September. I am pleased to see another set of reports become fixes people can install.

The earlier Short Circuit Apple CVE credits

Check the update available for each Apple device you maintain, including devices on older supported branches, and confirm that installation finishes. Each research article links to the releases in which Apple lists its fix.

Apple’s security releases and update index