EUVD-2026-29250
GHSA-864f-vhp7-p9m2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Remote crafted file with no auth but required user interaction (UI:R); memory leak gives C:L, crash gives A:H, no integrity impact so I:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Tahoe 26.5. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.
AnalysisAI
Memory-corruption in Apple's operating-system file-processing components (iOS/iPadOS before 18.7.9, macOS Sequoia before 15.7.7, macOS Tahoe before 26.5) lets a remote attacker cause a denial-of-service crash or leak fragments of process memory when a victim opens a maliciously crafted file. Rated CVSS 7.1, it is unauthenticated but requires user interaction to open the file. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and it is not on CISA KEV.
Technical ContextAI
The flaw is classified CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) - a buffer overflow, per the vendor tags. It resides in the shared file-parsing code that Apple ships across its platforms (CPE lists cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos), meaning the vulnerable routine is a common component rather than a single app. Apple's own description states it was 'addressed with improved checks,' indicating a missing or insufficient bounds check during parsing of untrusted file structures; out-of-bounds reads explain the memory-disclosure path, while out-of-bounds access or corruption explains the crash/DoS path.
RemediationAI
Vendor-released patch: update to iOS 18.7.9, iPadOS 18.7.9, macOS Sequoia 15.7.7, or macOS Tahoe 26.5, whichever applies to the device, per Apple's advisories at https://support.apple.com/en-us/127111, https://support.apple.com/en-us/127115, and https://support.apple.com/en-us/127116. Because exploitation requires a user to open a malicious file, the effective compensating control until patching is to avoid opening files from untrusted sources and to filter/quarantine such files at email and web gateways; on managed fleets, prioritize the update on devices that routinely process externally sourced documents. There is no vendor-documented feature toggle to disable the affected parser, so patching is the only complete fix.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today