EUVD-2026-29250
GHSA-864f-vhp7-p9m2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious file
-
DeliveryDeliver via email/message/download
-
ExploitVictim opens file
-
ExecutionTrigger out-of-bounds access in parser
-
ImpactCrash process or leak memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or process a maliciously crafted file on an unpatched Apple device (iOS/iPadOS <18.7.9, macOS Sequoia <15.7.7, macOS Tahoe <26.5); per the CVSS vector this is unauthenticated (PR:N) and remote (AV:N) but gated by mandatory user interaction (UI:R), so it cannot fire without the user handling the file. Limiting factors: the attack is not automatable (SSVC), impact is bounded to a crash or partial memory read (no code execution or integrity impact is claimed), and it only affects the listed pre-patch versions. |
| Impact | The signals align toward moderate, non-urgent risk. CVSS 7.1 is driven by A:H (DoS) and C:L (partial memory disclosure), but the vector requires user interaction (UI:R), and no integrity impact exists (I:N). EPSS is 0.02% (4th percentile) and CISA SSVC scores Exploitation: none, Automatable: no, Technical Impact: partial - all consistent with no observed exploitation. There is no KEV listing and no POC signal, and the low EPSS agrees with that picture. The main real-world constraint is that exploitation is not automatable and needs a user to open a crafted file, so mass or wormable exploitation is unlikely; this is a patch-in-normal-cycle issue rather than an emergency, though the ubiquity of Apple devices raises aggregate exposure. |
| Exploit ScenarioDerived | An attacker crafts a malformed file and delivers it via email, message, or a web download; when the victim opens it on an unpatched device, the parser reads or writes out of bounds, crashing the process (DoS) or returning bytes of adjacent process memory to the attacker-controlled content path. No public POC is known, and the crafted-file delivery plus required user action limits the scenario to targeted or opportunistic phishing-style attacks rather than automated mass exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Memory-corruption in Apple's operating-system file-processing components (iOS/iPadOS before 18.7.9, macOS Sequoia before 15.7.7, macOS Tahoe before 26.5) lets a remote attacker cause a denial-of-service crash or leak fragments of process memory when a victim opens a maliciously crafted file. Rated CVSS 7.1, it is unauthenticated but requires user interaction to open the file. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and it is not on CISA KEV.
RemediationAI
Vendor-released patch: update to iOS 18.7.9, iPadOS 18.7.9, macOS Sequoia 15.7.7, or macOS Tahoe 26.5, whichever applies to the device, per Apple's advisories at https://support.apple.com/en-us/127111, https://support.apple.com/en-us/127115, and https://support.apple.com/en-us/127116. Because exploitation requires a user to open a malicious file, the effective compensating control until patching is to avoid opening files from untrusted sources and to filter/quarantine such files at email and web gateways; on managed fleets, prioritize the update on devices that routinely process externally sourced documents. There is no vendor-documented feature toggle to disable the affected parser, so patching is the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) - a buffer overflow, per the vendor tags. It resides in the shared file-parsing code that Apple ships across its platforms (CPE lists cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos), meaning the vulnerable routine is a common component rather than a single app. Apple's own description states it was 'addressed with improved checks,' indicating a missing or insufficient bounds check during parsing of untrusted file structures; out-of-bounds reads explain the memory-disclosure path, while out-of-bounds access or corruption explains the crash/DoS path.
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Remote crafted file with no auth but required user interaction (UI:R); memory leak gives C:L, crash gives A:H, no integrity impact so I:N.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Tahoe 26.5. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.
Zero Day Initiative Advisories
Executive ViewAI
Apple's iOS, iPadOS, and macOS file-processing components contain a memory-corruption vulnerability (CVE-2026-28941, CVSS 7.1) allowing remote attackers to crash devices or leak sensitive data when users open malicious files. No public exploit identified at time of analysis. Organizations with Apple device fleets should prioritize patching within 30 days to prevent potential service disruption and data exposure.
Apply vendor patch: iOS/iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Tahoe 26.5.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB