Apple iOS 27.2 Released With Fixes for 163 Vulnerabilities, Including Fix for Critical WebKit RCE - CyberSecurityNews

Apple has released iOS 27.2, a significant security update that addresses 163 vulnerabilities across the operating system. The update includes patches for critical flaws in multiple Apple frameworks, with some potentially allowing attackers to execute arbitrary code, access sensitive user data, or gain unauthorized system privileges.

Among the most critical vulnerabilities fixed is CVE-2026-86971, a WebKit remote code execution flaw that could allow attackers to compromise devices through maliciously crafted web content. Apple has addressed this issue with improved input validation in the WebKit component.

Multiple Framework Vulnerabilities

The update addresses numerous issues in Apple's core frameworks, including the Accelerate Framework, where processing maliciously crafted images could lead to unexpected app termination. Several vulnerabilities in the Accounts framework were also patched, including issues that could allow malicious applications to bypass privacy preferences or access sensitive user data.

The Apple Neural Engine, which powers machine learning features, contained multiple vulnerabilities that could potentially cause system termination or corrupt kernel memory through out-of-bounds write issues. These have been addressed with improved bounds checking.

Media Processing Flaws

Several critical vulnerabilities were found in media processing components. The AppleAVD framework contained issues where processing maliciously crafted video files could lead to unexpected app termination or corrupt process memory. Similar problems existed in the CoreAudio framework, where maliciously crafted audio files could cause memory corruption or system termination.

Image processing components were also affected, with multiple CVEs in ImageIO where maliciously crafted images could result in memory disclosure or corruption. These issues have been addressed with improved memory handling and bounds checking.

System-Level Protections

The update includes fixes for several system-level vulnerabilities that could potentially allow attackers with physical access to compromise devices. These include issues in the IOKit framework that could lead to buffer overflows, and vulnerabilities in the IOHIDFamily that might allow reading kernel memory.

Apple has also addressed Bluetooth security concerns, where attackers in physical proximity could cause denial-of-service conditions. The HomeKit framework received updates to prevent unauthorized access to sensitive user data through improved checks.

User Data Protection

Multiple vulnerabilities that could allow access to sensitive user data have been patched across various frameworks including Calendar, CloudKit, Contacts, and FileProvider. These fixes include additional permission restrictions, improved state management, and better access controls.

The App Store framework received updates to address issues where apps could potentially access sensitive data or break out of the WebContent sandbox. Apple has implemented improved authorization mechanisms and input validation to prevent these exploits.