EUVD-2026-49468
GHSA-hx6f-whc9-5pw7
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector, low complexity, no privileges needed after user interaction to open a crafted file.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Processing a maliciously crafted image may lead to arbitrary code execution.
AnalysisAI
Arbitrary code execution in Apple macOS through image processing is fixed in macOS Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6. A buffer overflow in handling maliciously crafted images allows local attackers to execute arbitrary code with the victim's privileges upon opening the file. No active exploitation or public proof-of-concept is reported; EPSS predicts low exploitation probability (0.19%).
Technical ContextAI
The vulnerability is a classic buffer overflow (CWE-120) in the image parsing components of macOS, likely within the ImageIO framework or a related library. When processing a specially crafted image file, insufficient bounds checking can overflow a buffer, permitting an attacker to overwrite adjacent memory and hijack execution flow. The CPE identifier 'cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*' confirms that all macOS versions prior to the fixed releases are affected across the product line.
RemediationAI
Apply the vendor patch by upgrading to macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, or macOS Tahoe 26.6 or later. No workarounds are provided; the only mitigation is to avoid opening untrusted image files until the update can be applied. Detailed upgrade instructions are in the Apple security advisories referenced.
Same weakness CWE-120 – Classic Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today