EUVD-2026-29239
GHSA-8pvj-crrw-v6jv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Malicious file deliverable over network requires only victim interaction; no auth or special config needed; impact is crash-only with no data exposure or integrity effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Parsing a maliciously crafted file may lead to an unexpected app termination.
AnalysisAI
Out-of-bounds read (CWE-125) in Apple's file parsing subsystem causes unexpected application termination across all major Apple platforms when a maliciously crafted file is processed. Affected platforms include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS - all prior to their respective 26.5 releases. The impact is limited to availability (denial of service via app crash); no confidentiality or integrity impact is indicated. No public exploit code exists and no active exploitation has been confirmed: EPSS stands at 0.02% (6th percentile) and CISA has not added this to KEV.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) indicates that a bounds check was absent or insufficient when parsing a file of an unspecified format shared across Apple's OS family. The root cause is a memory-safety defect: the parser reads beyond a valid buffer boundary, producing undefined behavior that in this case manifests as an abort/crash (availability loss) rather than memory disclosure or code execution, consistent with the CVSS impact metrics C:N/I:N/A:H. Apple's fix description ('improved bounds checking') confirms a missing or inadequate length/range validation in the parsing routine. The vulnerability is present in a parsing component common to all Apple platforms (cpe:2.3:a:apple:ios_and_ipados, macos, tvos, visionos, watchos), suggesting a shared framework or library - likely a system-level media or document parser - rather than a platform-specific module. The exact file format is not disclosed in the advisory.
RemediationAI
The primary fix is to update all affected Apple devices to their respective 26.5 releases: iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5, available through the standard Apple software update mechanism. Patch confirmed as available per Apple's vendor advisory (https://support.apple.com/en-us/127110 and related pages). No effective workaround exists for the underlying parsing flaw short of patching, since the trigger is any file-open action in the vulnerable parser. As a compensating control for unpatched devices, users and administrators should exercise caution opening files from untrusted sources (email attachments, web downloads, AirDrop from unknown senders) to reduce exposure, though this is a behavioral mitigation only and does not eliminate the vulnerability. Enterprise MDM environments can enforce update compliance policies to ensure fleet-wide patching.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today