EUVD-2026-29276
GHSA-qmqx-qxq3-57q5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker creates malformed file
-
DeliveryDelivers file via email/storage/messaging
-
ExploitUser opens or system auto-processes file
-
ExecutionParser reads file without bounds validation
-
PersistMemory corruption occurs
-
ImpactApplication crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local file access and processing of a maliciously crafted file; the vulnerability cannot be triggered remotely over a network. No user interaction is formally required by the CVSS metric (UI:N), but in practice, an attacker must either convince a user to open the file or rely on automatic file processing (e.g., indexing, cloud sync, email preview). The specific file format and parser affected are not disclosed in available advisories. No special system configuration or privilege escalation is required; any user can trigger the flaw by processing the malicious file. The vulnerability affects all versions of the listed operating systems below the patched versions - there is no version-specific mitigation or safe configuration. |
| Impact | CVSS score of 6.2 (Medium) with local attack vector (AV:L), low complexity (AC:L), no privileges required, and high availability impact (A:H) indicates a straightforward local denial-of-service. However, the extremely low EPSS score (0.02%, percentile 7%) significantly contradicts the CVSS rating, suggesting minimal real-world exploitation likelihood. The discrepancy likely reflects that: (1) exploitation requires local file access and processing rather than network delivery, (2) impact is limited to denial of service (app crash) rather than code execution or data breach, and (3) the vulnerability appears patched quickly across all platforms with no evidence of active exploitation or public POC. This is a classic example of a moderate-CVSS, low-EPSS vulnerability better suited for regular patch cycles than emergency incident response. The lack of confidentiality or integrity impact and the requirement for local malicious file processing further reduce practical risk. |
| Exploit ScenarioDerived | An attacker crafts a malicious file (format not specified) and either delivers it via email, messaging application, or cloud storage accessible to the target device. When the user opens or the system automatically processes the file, the bounds-checking flaw triggers memory corruption in the file parser, causing the affected application to crash. Repeat crafting of such files could be weaponized for persistent denial of service against specific applications or workflows that depend on file processing. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 13, 2026
Improper bounds checking in Apple operating systems allows processing of maliciously crafted files to cause unexpected application termination (denial of service) on iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The vulnerability affects multiple major OS versions and requires local file processing without user interaction, but has extremely low real-world exploitation probability (EPSS 0.02%) despite moderate CVSS score.
RemediationAI
Vendor-released patches are available across all affected platforms: upgrade iOS/iPadOS to 18.7.9 or 26.5, macOS Sequoia to 15.7.7, macOS Sonoma to 14.8.7, macOS Tahoe to 26.5, tvOS to 26.5, visionOS to 26.5, and watchOS to 26.5. Until patching is completed, restrict users' ability to open untrusted files from external sources, particularly those of file types known to trigger the vulnerable parser (specific file types not disclosed in available advisory). If file processing is business-critical and patching cannot be scheduled immediately, consider sandboxing file processing operations in isolated user accounts with minimal system privileges or using network-based file validation proxies that reject malformed files before delivery to vulnerable clients. Note that delaying patches on mobile platforms (iOS, watchOS) is high-risk given the prevalence of automatic background file handling; prioritize these updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper bounds checking (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in Apple's file processing logic. CWE-119 encompasses buffer overflows and similar memory access violations. The affected components span Apple's unified codebase across iOS 18.x/26.x, macOS Sequoia (15.x), Sonoma (14.x), Tahoe (26.x), tvOS, visionOS, and watchOS platforms, all built on similar kernel and framework architectures. The vulnerability triggers when a crafted file is processed locally, suggesting the flaw exists in a file parser or handler that lacks proper validation of file structure or content length before memory operations.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (apple) · only source for this CVE.
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted file may lead to unexpected app termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB