InfoSecBulletin Cybersecurity for mankind
Apple credits Md Rasel Bhuyan and fellow researcher Musaab Khan for discovering an out-of-bounds write vulnerability affecting multiple Apple operating systems. Bangladeshi cybersecurity researcher Rasel Bhuyan has achieved a significant milestone in his security research career after Apple officially acknowledged his contribution to a vulnerability assigned CVE-2026-112486.
The vulnerability affects Apple’s Model I/O framework, which handles the processing of 3D models. According to Apple’s security advisories, processing a 3D model could trigger an out-of-bounds write issue, potentially causing an application to terminate unexpectedly.
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
Multiple European supermarket fridges got hacked: Temperatures reached high as 55°C
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
Daily Cyber security update for 31.10. 2026
Bhuyan announced the achievement on social media, describing it as his first CVE acknowledgement from Apple. He expressed gratitude to Almighty Allah and highlighted the extensive learning, experimentation, research, and persistence behind the milestone.
Details of the vulnerability
Tracked as CVE-2026-112486, the security flaw is classified as an Out-of-Bounds Write (CWE-787) vulnerability. An out-of-bounds write occurs when software attempts to write data beyond the boundaries of an allocated memory area. Depending on the circumstances, such vulnerabilities can cause application crashes, memory corruption, or potentially more serious security consequences.
In this particular case, Apple describes the impact as unexpected application termination when processing a 3D model. Apple addressed the issue through improved bounds checking, a security measure designed to ensure that software operations remain within valid memory boundaries.
Affected Apple versions
Apple has documented CVE-2026-112486 across multiple operating system releases, including:
visionOS 27.2 – Apple Vision Pro (all models)
macOS Golden Gate 27.2
iOS 27.2
iPadOS 27.2
The affected device ranges vary depending on the operating system and release.
Apple has published security documentation for the vulnerability across its relevant platform advisories.
Official Apple Security Advisories
support.apple.com/149526
support.apple.com/149521
support.apple.com/149230
Md Rasel Bhuyan said infosecbulletin that “the journey toward this CVE was one defined by a long wait, patience, and relentless research. I first reported the vulnerability to Apple on August 6, 2026, at 5:55 AM. Following an extensive verification process and a long wait, Apple finally published CVE-2026-112486 on October 26, 2026. This roughly 80-day journey has taught me the true importance of patience and perseverance in the field of cybersecurity research. I am immensely grateful to Allah for this recognition of my research. Insha’Allah, I look forward to achieving much more in the future.”
Related News:
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
How Bangladeshi’s Ogrs Be Evaluated By Newly Launched NRS & CIRS
