EUVD-2025-209193
GHSA-836c-rhv9-3x5j
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Risk is moderate despite the 6.3 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) indicates network-reachable attack surface with low complexity, but requires user interaction to open a malicious media file. SSVC framework signals align with lower exploitation urgency: exploitation status is 'none' (no active exploitation), automatable is 'no' (requires user action to trigger), and technical impact is 'partial' (not full system compromise). No KEV status or public exploit code identified. The vulnerability is real and affects millions of Apple users, but practical exploitability is constrained by user action dependency. Organizations should prioritize patching for devices handling untrusted media, but this is not a critical emergency requiring immediate out-of-band patching. |
| Exploit ScenarioDerived | An attacker crafts a malicious media file (e.g., MP4, image, or audio file) with an out-of-bounds write trigger and distributes it via email, messaging app, or compromised website. When a user opens or plays the file in a media application (Photos, Safari, Music, or similar), the media processing library reads the malicious file header, fails to validate buffer boundaries, and writes beyond allocated memory. The app crashes (denial of service) or the attacker gains limited information disclosure through memory corruption. No public exploit code is available, and the attack requires active user engagement with the malicious file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
Out-of-bounds memory access in Apple media processing affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, allowing remote attackers to trigger unexpected application termination or memory corruption through maliciously crafted media files. The vulnerability requires user interaction (opening/playing the malicious file) but no authentication. Apple has released patched versions for all affected platforms with CVSS 6.3 (moderate severity) and no public exploitation identified at time of analysis.
RemediationAI
Vendor-released patches are available for all affected platforms: update to iOS 18.6, iPadOS 18.6 (or 17.7.9 for older iPad models), macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, or watchOS 11.6. No formal workarounds exist; patching is the primary remediation. Users should avoid opening untrusted media files from unknown sources pending update deployment. Device administrators should prioritize patching iOS/iPadOS devices first due to higher user population, followed by macOS. Refer to device-specific security updates at https://support.apple.com/en-us/124147 through https://support.apple.com/en-us/124155 for download links and detailed patching instructions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic out-of-bounds write vulnerability (CWE-787: Out-of-bounds Write) in Apple's media processing subsystem, likely affecting frameworks used across iOS, macOS, tvOS, visionOS, and watchOS for handling various media file formats. The root cause is insufficient bounds checking when parsing or decoding media file headers or content, permitting an attacker to write data beyond allocated buffer boundaries. The vulnerability impacts the media handling stack common to all Apple OSes, explaining the broad CPE coverage across cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, and related OS CPEs. The flaw can corrupt process memory (information disclosure) or crash the affected application (denial of service).
Know when Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Primary rating from Vendor (apple) · only source for this CVE.
CVSS VectorVendor: apple
Lifecycle Timeline
2DescriptionCVE.org
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
Exploit-DB