EUVD-2026-49452
GHSA-2gqg-xm37-vrf5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious audio file
-
DeliveryDeliver via email/message/web
-
ExploitVictim opens/previews file
-
ExecutionAudio parser overflows memory buffer
-
PersistCorrupt process memory
-
ImpactExecute code in app context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to process a maliciously crafted audio file on an unpatched Apple device (iOS/iPadOS <26.6, macOS Sonoma <14.8.8, macOS Sequoia <15.7.8, macOS Tahoe <26.6, tvOS/visionOS/watchOS <26.6). The CVSS vector (AV:L/UI:R/PR:N) confirms no attacker privileges are needed, but the attack is gated by required user interaction - the target must open, preview, or otherwise let an application parse the attacker-supplied audio file. Limiting factors: no remote unauthenticated auto-exploitation, scope is unchanged (S:U, so impact stays within the parsing process), and only devices below the fixed versions are vulnerable. |
| Impact | The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - high impact but gated by a local attack vector and required user interaction (the target must process the malicious file). Real-world exploitation signals are modest: EPSS is only 0.16% (5th percentile), and CISA SSVC scores Exploitation as 'none' and Automatable as 'no,' though Technical Impact is 'total,' matching the C:H/I:H/A:H rating. There is no KEV listing and no public exploit identified, so this is a genuine full-impact memory-corruption bug but not currently an urgent, mass-exploited threat - priority should be driven by the ubiquity of Apple devices and the ease of delivering files rather than by observed exploitation. No signals conflict; the low EPSS and 'none' SSVC exploitation status are consistent with the local/UI-gated vector. |
| Exploit ScenarioDerived | An attacker crafts a malformed audio file and delivers it via email, a messaging app, a website, or a shared document; when the victim opens or previews the file, the audio parser corrupts process memory and the attacker gains control over the affected process, potentially achieving code execution in the app's context. Because user interaction is required and the vector is local, this fits targeted phishing or watering-hole delivery rather than automated remote exploitation; no public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Memory corruption in Apple's audio processing framework affects iOS, iPadOS, macOS (Sonoma, Sequoia, Tahoe), tvOS, visionOS, and watchOS, where parsing a maliciously crafted audio file can corrupt process memory and potentially lead to arbitrary code execution. The flaw requires a victim to open or process the malicious file (local vector, user interaction) but no prior privileges. Apple has shipped fixes across all platforms; no public exploit identified at time of analysis and EPSS is low (0.16%).
RemediationAI
Vendor-released patch: update to iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6, per Apple's advisories at https://support.apple.com/en-us/128066 through https://support.apple.com/en-us/128072. There is no vendor-documented configuration workaround; until devices are updated, the practical compensating control is to avoid opening audio files from untrusted sources and to block or quarantine inbound audio attachments at mail/web gateways (trade-off: may disrupt legitimate media workflows). Enterprise fleets should push the updates via MDM and prioritize internet-facing and high-value user devices first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lies in Apple's media/audio decoding path (the frameworks responsible for parsing audio container and codec data, e.g. CoreAudio/AudioToolbox), which are shared across all of Apple's operating systems. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) is the root-cause class, and the vendor tag 'Buffer Overflow' indicates that malformed length or offset fields in the audio file drive reads/writes outside the intended buffer bounds. Apple states the issue was resolved through 'improved memory handling,' consistent with added bounds validation in the parser. The affected CPEs span apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, and apple:watchos, confirming this is a cross-platform defect in common Apple media code rather than a single product.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be locally processed (AV:L) with victim interaction (UI:R) and no privileges (PR:N); memory corruption plausibly yields full C/I/A impact within the unchanged process scope.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted audio file may corrupt process memory.
Zero Day Initiative Advisories
Executive ViewAI
Memory corruption in Apple's audio processing framework affects all major Apple platforms (iOS, iPadOS, macOS, tvOS, visionOS, watchOS), enabling arbitrary code execution when users process malicious audio files. With patches now available, the organization must prioritize deployment across its entire Apple device ecosystem to eliminate this high-severity vulnerability affecting a critical technology platform.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB