Apple OS platforms CVE-2026-43661

Exploitation requires only that the target device processes a maliciously crafted image file through Apple's vulnerable image parsing framework. This occurs automatically in default configurations when images are rendered in Safari, Mail, Messages, Photos, or any application using system imaging APIs. No user interaction beyond normal device usage is required (UI:N in CVSS vector), as image previews are generated automatically by iOS/iPadOS, macOS, tvOS, and watchOS. No authentication is necessary (PR:N) since the vulnerability is triggered during image parsing before any access control checks. The network attack vector (AV:N) indicates exploitation can occur remotely through any pathway delivering image data: web browsing, email, messaging, AirDrop, or network file shares. Exploitation is NOT limited by specific feature enablement or non-default settings-all unpatched Apple devices running versions below 26.5 are vulnerable during normal operation.

The risk profile shows significant discrepancy between CVSS severity and real-world exploitation signals. CVSS 7.5 (High) reflects the technical ease of exploitation (AC:L, no authentication or user interaction required) and availability impact. However, the EPSS score of 0.02% (5th percentile) suggests security researchers and threat actors have shown minimal interest in weaponizing this vulnerability class against Apple platforms. The vulnerability is NOT listed in CISA KEV, confirming no active exploitation has been observed. The impact limitation to availability only (C:N/I:N/A:H) reduces appeal for targeted attacks, as attackers typically prefer code execution or data exfiltration capabilities. The simultaneous patching across four operating systems indicates Apple identified this through internal security audit rather than incident response, further supporting the absence of in-the-wild exploitation. The low EPSS score despite network-accessible attack surface may reflect robust platform-level mitigations in modern Apple OS versions (ASLR, stack canaries, sandboxing) that convert theoretical buffer overflows into practical denial-of-service only. Priority should be moderate: patch during normal maintenance windows rather than emergency deployment, focusing first on internet-facing systems processing untrusted images.

An attacker hosts a maliciously crafted image file (PNG, JPEG, or other supported format) on a compromised website or embeds it in a phishing email. When a victim's device automatically renders the image preview-either through a web browser visiting the page, an email client displaying message content, or a messaging app showing received media-the image parser triggers the buffer overflow. The corrupted process memory causes the application or system service to crash, resulting in denial of service. On enterprise devices processing images at scale (MDM servers, email gateways, content inspection systems), repeated exploitation could cause sustained service disruption.