EUVD-2026-49441
GHSA-6wwc-jxw9-5qhh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious image file
-
DeliveryDeliver via message/email/web
-
ExploitVictim processes image
-
ExecutionTrigger out-of-bounds buffer overflow
-
ImpactCorrupt process memory
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to process a maliciously crafted image with an affected Apple OS (any pre-26.6 / pre-15.7.8 / pre-14.8.8 build) - i.e., the image must be delivered to and rendered/parsed by the target (UI:R), so there is no remote unauthenticated auto-exploitation of a listening service. No authentication or special privileges are needed on the attacker side (PR:N), and no non-default configuration is required since image handling is a core, always-available OS function. The primary limiting factor is the need for user interaction to open or preview the image and the absence of privilege escalation in a single step (scope unchanged, S:U); it affects all listed Apple platforms in vulnerable versions rather than a niche configuration. |
| Impact | Signals are consistent and point to a real but not urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) reflects that exploitation requires the victim to process a malicious file (UI:R) rather than a purely remote drive-by, and the vector is scored local (AV:L) because the malicious image must be delivered to and opened by the target. EPSS is low (0.17%, 6th percentile) and SSVC exploitation is 'none' with automatable 'no', so there is no evidence of mass exploitation; however SSVC technical impact is 'total,' matching the C:H/I:H/A:H impact metrics. Note a tension worth verifying: image-parsing bugs are frequently reachable via network-delivered content (messaging, web, email attachments), so while CVSS uses AV:L, real-world delivery can be remote-to-local - defenders should not read AV:L as 'requires physical/local presence.' No KEV listing and no POC lower immediate urgency, but the total technical impact and Apple's own reporting warrant timely patching. |
| Exploit ScenarioDerived | An attacker crafts a malformed image and delivers it to a victim via email attachment, a messaging app, or a web page; when the victim's device processes the image for display or preview, the malformed structure overflows a buffer and corrupts process memory. No public POC or exploit code has been identified, and successful exploitation requires the user to receive and process the crafted image (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Memory corruption in Apple's cross-platform image-processing stack allows a maliciously crafted image to corrupt process memory across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple self-reported and patched the flaw (fixed in iOS/iPadOS 26.6, macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and the 26.6 releases of tvOS/visionOS/watchOS). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and CISA SSVC records exploitation status as none, though the technical impact is rated total.
RemediationAI
Vendor-released patch: update to iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, or watchOS 26.6 as applicable to each device, referencing the platform-specific advisories at https://support.apple.com/en-us/128066 through https://support.apple.com/en-us/128072. There is no vendor-documented configuration workaround since the flaw is in core image handling; as an interim compensating control, avoid opening images from untrusted sources and restrict automatic image rendering/previews where feasible (e.g., disabling automatic media loading in messaging/mail clients), accepting the usability trade-off of manual media handling. Deploy the updates through MDM for managed fleets to close the window quickly given the total technical impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 improper restriction of operations within memory bounds (buffer overflow), triggered during image decoding/parsing. The affected component is Apple's shared image-handling code (broadly the ImageIO/CoreGraphics family that underpins all listed OSes), which is why a single CVE spans cpe:2.3:a:apple:ios_and_ipados, :macos, :tvos, :visionos, and :watchos. Apple's advisory language ('addressed with improved memory handling') indicates the root cause was insufficient bounds validation when handling attacker-controlled image structure, allowing out-of-bounds read/write that corrupts adjacent process memory - a classic precursor to memory-safety exploitation.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious image must be opened by the victim, so AV:L and UI:R with PR:N; memory corruption yields high C/I/A and unchanged scope.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
3DescriptionCVE.org
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted image may corrupt process memory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB