What is the CVSS score of EUVD-2026-29292?

EUVD-2026-29292 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-29292?

Yes, a patch is available for EUVD-2026-29292. Update the affected software to the latest version immediately.

Apple Platforms EUVD-2026-29292

| CVE-2026-39869 MEDIUM

Classic Buffer Overflow (CWE-120)

2026-05-11 apple

GHSA-qfc3-4682-w48w

Buffer Overflow Apple Tvos Visionos Watchos Ios And Ipados

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Network delivery of crafted media file requires user interaction (UI:R); impact is process-only DoS with no confidentiality or integrity loss (C:N/I:N/A:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:39 vuln.today

CVSS changed

May 12, 2026 - 19:22 NVD

4.3 (MEDIUM)

Patch available

May 11, 2026 - 22:18 EUVD

CVE Published

May 11, 2026 - 20:08 nvd

MEDIUM 4.3

CVE Published

May 11, 2026 - 20:08 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing an audio stream in a maliciously crafted media file may terminate the process.

AnalysisAI

Process termination via buffer overflow in Apple's audio stream parser affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS across all supported release lines. Opening a maliciously crafted media file triggers a CWE-120 buffer copy without bounds checking during audio stream processing, crashing the media-handling process. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.02% (7th percentile), and SSVC classifies this as non-automatable with partial technical impact - placing it firmly in the patch-on-schedule tier rather than emergency response.

Technical ContextAI

The root cause is CWE-120 (Classic Buffer Overflow / Buffer Copy Without Checking Size of Input) in Apple's audio stream processing subsystem, common across the shared media frameworks used by iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple's advisory language - 'addressed with improved memory handling' - is consistent with a bounds-check repair in a media decoder or demuxer path. CPE strings (cpe:2.3:a:apple:ios_and_ipados, macos, tvos, visionos, watchos) confirm the flaw spans the unified Apple platform stack, likely in a shared audio codec library (e.g., Core Audio or a bundled third-party decoder). The CVSS vector AV:N/UI:R reflects delivery via a network-hosted or app-shared media file that a user must open, triggering the vulnerable parse path. The Availability:Low impact is consistent with a controlled process crash rather than kernel panic or device brick.

RemediationAI

Vendor-released patches are available. Update to iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, or watchOS 26.5 via System Settings > General > Software Update (iOS/iPadOS/macOS) or the companion app (tvOS/watchOS/visionOS). Advisory pages are listed per platform at the Apple support URLs above. If immediate patching is not feasible, a compensating control is to disable or restrict the opening of media files from untrusted sources through MDM policy (e.g., Apple Business Manager content restrictions) or mail/message filtering rules that quarantine audio/video attachments - note this may impact legitimate productivity workflows. There is no known workaround that mitigates the underlying parser flaw without the patch.