EUVD-2026-15060Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The risk profile of this vulnerability is moderate to high despite the absence of a CVSS score and EPSS rating. The attack vector is network-based (users can receive malicious media files via email, messaging, or web downloads), and attack complexity is low since the only requirement is crafting a maliciously formatted media file. The vulnerability affects a broad attack surface across six major Apple operating systems and all compatible devices, significantly expanding the potential victim population. However, the immediate impact is denial of service (process termination) rather than code execution or data exfiltration, which limits the severity. The availability of patch information through multiple Apple support articles (126792-126799) indicates active vendor remediation, and the rapid patching across all platforms suggests Apple prioritized this issue. Without disclosed POC code or evidence of active exploitation in the wild, this appears to be a responsibly disclosed vulnerability with adequate vendor response, placing it in the moderate-risk category for unpatched systems but lower priority for organizations with timely patching capabilities. |
| Exploit ScenarioDerived | An attacker creates a malicious audio file embedded in a media container (such as MP4 or similar format) with a specially crafted audio stream header that omits or misrepresents the actual data size. When a user opens this file in an application that processes audio (such as Apple Music, iMovie, or any media player), the vulnerable audio processing code attempts to read beyond the allocated buffer while decoding the stream, triggering an out-of-bounds access that immediately terminates the application. This could be delivered via email attachment, messaging app, social media, or a compromised website, requiring only that the victim interact with the malicious file to trigger the denial of service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
Maliciously crafted media files containing out-of-bounds memory access in Apple's audio processing can crash affected applications across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An attacker can trigger a denial of service by triggering the vulnerability through a specially crafted audio stream, though no patch is currently available. This impacts multiple recent OS versions where an out-of-bounds read occurs during media file processing.
Earlier versions of this analysis (1)
An out-of-bounds memory access vulnerability exists in Apple's audio stream processing functionality across multiple operating systems and devices. An attacker can craft a malicious media file containing a specially formatted audio stream that triggers improper bounds checking, causing the affected application to terminate unexpectedly. This vulnerability affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS across multiple versions, and Apple has released patches for all affected platforms.
RemediationAI
Immediately upgrade all affected Apple devices to the patched versions: iOS and iPadOS to 18.7.7 or 26.4, macOS Sequoia to 15.7.5, macOS Sonoma to 14.8.5, macOS Tahoe to 26.4, and tvOS, visionOS, and watchOS to version 26.4. Organizations should prioritize patching systems that regularly process media files from untrusted sources, such as mail servers, web browsers, and media streaming applications. For users unable to immediately patch, restrict access to untrusted media files and disable automatic media preview features in applications that process audio streams. Consult Apple's official security advisories at https://support.apple.com/en-us/126792 through https://support.apple.com/en-us/126799 for platform-specific patching procedures and to verify successful update installation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability resides in Apple's media processing framework, specifically in the audio stream parsing and decoding components that handle various audio formats within media containers. The issue is classified as an out-of-bounds access flaw, which occurs when the audio processing code attempts to read or write memory beyond the allocated buffer boundaries without proper validation of the input stream's structure and size. The affected CPE ranges include cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:tvos, cpe:2.3:a:apple:visionos, and cpe:2.3:a:apple:watchos, indicating the vulnerability exists across Apple's entire ecosystem. The root cause relates to improper input validation and insufficient bounds checking when parsing audio stream headers or data segments, allowing an attacker-controlled media file to trigger memory access violations without proper size validation.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. Processing an audio stream in a maliciously crafted media file may terminate the process.
Zero Day Initiative Advisories
Executive ViewAI
Organizations using An out-of-bounds access should be aware of notable risk from CVE-2026-20690, a out-of-bounds read vulnerability rated CVSS 6.5. Exploitation could cause memory corruption or application crashes. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
Remote code execution in Google Chrome for iOS prior to 156.0.8078.47 is possible when a victim opens a crafted HTML pag
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared,
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
GitHub PoC
Exploit-DB