Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS CVE-2026-28956

User interaction is mandatory-the attacker must convince a user to download and open a malicious media file. The vulnerability activates only when vulnerable media-processing frameworks parse the crafted file, which occurs automatically upon opening in most Apple-bundled media applications (Photos, Music, TV, etc.) and third-party media players that use system frameworks. No special system configuration is required; default configurations of affected Apple operating systems are vulnerable. The memory corruption occurs during normal file processing by legitimate applications, so no elevated privileges are needed for exploitation.

This vulnerability presents a moderate real-world risk with contradictory signals requiring careful interpretation. The CVSS v3.1 score of 6.5 reflects network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), but critically requires user interaction (UI:R), making it a network-adjacent attack requiring the victim to open a crafted media file. The Availability impact (A:H) confirms denial-of-service potential through app crashes, while No Impact on Confidentiality or Integrity (C:N/I:N) suggests memory corruption does not reliably leak data or enable code execution. However, the EPSS score of 0.02% (7th percentile) significantly contradicts the CVSS severity, indicating extremely low practical exploitation probability in the wild. This dramatic gap between CVSS and EPSS is explainable: CVSS penalizes user interaction heavily in probability models, and the out-of-bounds read (not write) limits reliable memory corruption attacks. The low EPSS and absence of KEV confirmation or public POC suggest this is a reliability/DoS issue rather than an active security threat. SSVC decision framework would classify this as: Exploitation Status=Unspecified (no public POC), Automatable=No (requires user action), Technical Impact=Denial of Service (app crash/memory corruption). Organizations should patch during routine updates but this does not warrant emergency response given the low exploitation probability and lack of active threat indicators.

An attacker crafts a malicious media file (video, audio, or image) with specially formatted metadata or payloads designed to trigger an out-of-bounds read during processing. The attacker distributes this file via email, messaging apps, social engineering, or a compromised website. When a victim downloads and opens the file in a default media app or player, the memory corruption is triggered, causing the application to crash or exhibit unexpected behavior; in a worst-case scenario, an attacker might read sensitive data from adjacent memory regions, though this would require precision timing and multiple attempts.