EUVD-2026-49544
GHSA-v3r2-67q9-p9cr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted image delivered remotely but must be opened by the user (UI:R), needs no privileges (PR:N), and yields full memory-corruption RCE, so C/I/A all High.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Processing a maliciously crafted image may lead to arbitrary code execution.
AnalysisAI
Arbitrary code execution in Apple iOS, iPadOS, and macOS arises when the OS image-processing pipeline handles a maliciously crafted image, triggering an integer overflow (CWE-190) that can be leveraged to run attacker-controlled code. The flaw affects iOS/iPadOS before 26.6 and multiple macOS trains (Sonoma before 14.8.8, Sequoia before 15.7.8, Tahoe before 26.6) and requires the victim to open or process the malicious image (UI:R). No public exploit has been identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.
Technical ContextAI
The root cause is an integer overflow (CWE-190) in Apple's operating-system image decoding/processing code, the shared media-handling stack used across iOS, iPadOS, and macOS (referenced by CPEs cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos). Integer overflow bugs in image parsers typically occur when width/height/stride or allocation-size arithmetic wraps around a fixed-width integer, producing an undersized buffer that is then overflowed during pixel/decode operations, leading to memory corruption. Because image parsing is invoked automatically by many system components (Messages, Mail previews, Safari, QuickLook, Photos), such a corruption primitive can be escalated to arbitrary code execution in the context of the processing application.
RemediationAI
Vendor-released patch: update to iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6 as applicable to each device train, per Apple's advisories (https://support.apple.com/en-us/128066, https://support.apple.com/en-us/128067, https://support.apple.com/en-us/128071, https://support.apple.com/en-us/128072). Because the bug is triggered by processing a crafted image and no vendor-supported disable switch exists for the system image parsers, compensating controls until patching are limited to reducing exposure: caution users against opening images from untrusted senders, and where possible disable automatic message/link previews and iMessage/Mail auto-loading of remote content so images are not decoded without user intent (trade-off: degraded messaging usability). Prioritize patching high-value and internet-facing user devices first given the network attack vector.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Same weakness CWE-190 – Integer Overflow or Wraparound
View allShare
External POC / Exploit Code
Leaving vuln.today