EUVD-2026-29248
GHSA-c8pw-9v2c-4669
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (apple) · only source for this CVE.
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. Processing a maliciously crafted file may lead to unexpected app termination.
AnalysisAI
High confidentiality information disclosure across Apple's ecosystem (iOS, iPadOS, macOS, visionOS) allows remote unauthenticated attackers to extract sensitive data by delivering a maliciously crafted file. The vulnerability affects all current Apple operating systems and was fixed in March 2026 security updates (iOS/iPadOS 18.7.9/26.5, macOS 14.8.7/26.5, visionOS 26.5). Despite CVSS 7.5 HIGH rating and network attack vector requiring no privileges, EPSS exploitation probability is very low at 0.02% (5th percentile), suggesting minimal real-world risk. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.
Technical ContextAI
This is an input validation vulnerability (CWE-20: Improper Input Validation) affecting file processing components across Apple's operating system family. The CVE spans multiple CPE entries for iOS/iPadOS, macOS (Sonoma and Tahoe releases), and visionOS, indicating a shared code component or framework handling file parsing. Apple addressed it with 'improved checks', suggesting insufficient validation of file structure, metadata, or embedded content that could be exploited to leak memory contents or filesystem data. The CVSS vector shows pure confidentiality impact (C:H/I:N/A:N) with no integrity or availability effects, distinguishing this from typical denial-of-service file parsing bugs. The description mentions 'unexpected app termination' which contradicts the CVSS availability score of None, suggesting the primary exploitable impact is information disclosure before termination occurs, or that Apple's initial description was conservative.
RemediationAI
Apply vendor-released security updates immediately: upgrade iOS and iPadOS to version 18.7.9 or 26.5 (depending on device generation), macOS Sonoma to 14.8.7, macOS Tahoe to 26.5, and visionOS to 26.5 as documented in Apple security advisories HT127110, HT127111, HT127115, HT127117, and HT127120 (https://support.apple.com/en-us/127110 through 127120). For devices unable to immediately patch, implement defense-in-depth controls: disable automatic file preview in Mail and Messages applications (Settings > Mail > Load Remote Content, Settings > Messages > Low Quality Image Mode), restrict AirDrop to Contacts Only (Settings > General > AirDrop), and train users to avoid opening unsolicited files from unknown sources. Note that disabling preview features reduces usability and does not eliminate risk if users manually open malicious files. Configure Mobile Device Management (MDM) policies to enforce rapid security update deployment across enterprise devices. For high-security environments, consider temporarily restricting file sharing capabilities until patching is complete, accepting productivity impact as trade-off for information disclosure prevention.
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerabi
An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
The issue was addressed with improved memory handling. Rated critical severity (CVSS 9.8), this vulnerability is remotel
A correctness issue was addressed with improved checks. Rated critical severity (CVSS 9.8), this vulnerability is remote
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today