Apple Image Processing CVE-2026-28990

Exploitation requires the target Apple device to process a maliciously crafted image file through any system image parsing API - including but not limited to: automatic thumbnail generation in Finder/Files app, email client preview rendering (Mail.app automatic image loading), web browser image display (Safari, WebKit-based apps), or third-party applications using Apple's ImageIO framework. CVSS vector AV:N/PR:N/UI:N indicates no special conditions - remote unauthenticated exploitation against default configurations of all affected Apple platforms. However, the confidentiality-only impact (C:H/I:N/A:N) reveals a critical exploitation limit: attackers can only read process memory contents, not execute arbitrary code or cause denial of service, reducing weaponization potential compared to typical buffer overflow vulnerabilities. The network attack vector suggests images can be delivered via web content, email attachments, messaging apps, or any network-accessible image source processed by the system. No platform-specific restrictions identified - vulnerability affects all Apple operating systems uniformly, suggesting a shared codebase component.

CVSS 7.5 HIGH rating reflects the theoretical worst-case: network-accessible (AV:N), low complexity (AC:L), no privileges or user interaction required (PR:N/UI:N). However, multiple risk signals present a nuanced picture that requires careful interpretation. EPSS probability of 0.02% (7th percentile) indicates minimal observed exploitation attempts in the wild, contradicting the high CVSS severity - this discrepancy suggests the vulnerability may require specific conditions not captured in the base score, such as particular image format handling contexts. The confidentiality-only impact (C:H/I:N/A:N) limits damage to memory disclosure rather than full system compromise, reducing appeal for mass exploitation. No CISA KEV listing confirms no widespread active exploitation despite network attack vector. No public POC identified at time of analysis. The broad platform reach (seven distinct OS products) expands attack surface but also accelerates vendor response - Apple's coordinated March 2026 patch release across all platforms demonstrates priority treatment. Real-world exploitation likely requires chaining with additional vulnerabilities to achieve meaningful impact beyond information leakage. Priority assessment: MEDIUM for general deployments (patch in normal cycle), HIGH for environments handling untrusted image content (web servers, email gateways, media processing systems) where memory disclosure could leak cryptographic keys, session tokens, or other sensitive runtime data.

An attacker hosts a weaponized image file on a malicious website or embeds it in a phishing email. When a victim's Apple device automatically renders the image thumbnail (iOS Mail preview, macOS Finder icon generation, Safari webpage rendering), the malformed image triggers a buffer overflow in the image parser, allowing the attacker to read adjacent process memory containing session tokens, encryption keys, or other sensitive data. The attacker exfiltrates this information through network callbacks embedded in the image metadata. Because the CVSS vector shows UI:N (no user interaction required), exploitation can occur during automatic background operations like thumbnail generation or email preview loading, without the user actively opening the file.