EUVD-2026-29292
GHSA-qfc3-4682-w48w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Network delivery of crafted media file requires user interaction (UI:R); impact is process-only DoS with no confidentiality or integrity loss (C:N/I:N/A:L).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing an audio stream in a maliciously crafted media file may terminate the process.
AnalysisAI
Process termination via buffer overflow in Apple's audio stream parser affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS across all supported release lines. Opening a maliciously crafted media file triggers a CWE-120 buffer copy without bounds checking during audio stream processing, crashing the media-handling process. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.02% (7th percentile), and SSVC classifies this as non-automatable with partial technical impact - placing it firmly in the patch-on-schedule tier rather than emergency response.
Technical ContextAI
The root cause is CWE-120 (Classic Buffer Overflow / Buffer Copy Without Checking Size of Input) in Apple's audio stream processing subsystem, common across the shared media frameworks used by iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple's advisory language - 'addressed with improved memory handling' - is consistent with a bounds-check repair in a media decoder or demuxer path. CPE strings (cpe:2.3:a:apple:ios_and_ipados, macos, tvos, visionos, watchos) confirm the flaw spans the unified Apple platform stack, likely in a shared audio codec library (e.g., Core Audio or a bundled third-party decoder). The CVSS vector AV:N/UI:R reflects delivery via a network-hosted or app-shared media file that a user must open, triggering the vulnerable parse path. The Availability:Low impact is consistent with a controlled process crash rather than kernel panic or device brick.
RemediationAI
Vendor-released patches are available. Update to iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, or watchOS 26.5 via System Settings > General > Software Update (iOS/iPadOS/macOS) or the companion app (tvOS/watchOS/visionOS). Advisory pages are listed per platform at the Apple support URLs above. If immediate patching is not feasible, a compensating control is to disable or restrict the opening of media files from untrusted sources through MDM policy (e.g., Apple Business Manager content restrictions) or mail/message filtering rules that quarantine audio/video attachments - note this may impact legitimate productivity workflows. There is no known workaround that mitigates the underlying parser flaw without the patch.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today