
Reproduced CVE-2026-112705: AppleAVE2 kernel OOB write on iOS 27.0.1. Setting VideoToolbox NumberOfTemporalLayers=16463 panics the kernel on first encode. Fixed in iOS 27.2. PoC + panic log: https://github.com/MchinaMd57764/AVETemporalPoC-CVE-2026-112705 Found by Calif / Chollima team — independent repro. #iOS #CVE https://t.co/5DAKSwgtWB

