EUVD-2026-60506
GHSA-pqq2-6hv4-3h7j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious image payload
-
DeliveryDeliver image via email/web/iMessage to victim
-
ExploitVictim opens or previews image
-
ExecutionImage parser triggers uncontrolled resource exhaustion
-
ImpactApplication or device crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | User interaction is required - the victim must actively open, preview, or otherwise trigger image decoding of the crafted file; automated remote exploitation without victim action is precluded by the UI:R CVSS metric. The attacker requires no authentication or privileges (PR:N), meaning any network-reachable delivery mechanism (email, messaging, web) suffices to stage the file. Exploitation is limited to iOS/iPadOS versions prior to 26.6.1 and macOS Tahoe versions prior to 26.6.2; no non-default configuration is required, as the standard image processing stack present in all affected Apple platforms is the vulnerable component. Impact is strictly bounded to availability (device/app crash or hang); no confidentiality or integrity compromise is possible via this vector (C:N/I:N confirmed by CVSS). |
| Impact | CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) accurately reflects the risk profile: network-reachable with low complexity, but requiring user interaction to trigger and limited exclusively to availability impact. EPSS at 0.15% (5th percentile) strongly corroborates the low exploitation probability. The absence of a KEV listing and no known POC confirm this has not been weaponized at scale. The UI:R requirement is a genuine, meaningful barrier - automated exploitation without user action is not feasible under this vector. Real-world priority is moderate for consumer device fleets and MDM-managed Apple estate: unpatched devices exposed to attacker-controlled image content (via email, iMessage, or web browsing) face a plausible crash/hang scenario. For enterprise environments with patching cadences, this should be addressed in the next standard patch cycle rather than treated as emergency remediation. |
| Exploit ScenarioDerived | An attacker crafts a malicious image file exploiting the uncontrolled resource consumption flaw and delivers it to a target via email attachment, iMessage, a web page, or a shared album link. The victim on a vulnerable iOS, iPadOS, or macOS version opens or previews the image, causing the image processing subsystem to exhaust available resources and rendering the application or device unresponsive. No public exploit code has been identified, making opportunistic mass exploitation unlikely at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Uncontrolled resource consumption in Apple's image processing subsystem affects iOS/iPadOS (prior to 26.6.1) and macOS Tahoe (prior to 26.6.2), enabling a network-reachable denial-of-service when a user processes a specially crafted image. Apple has released patches across both platform families via support advisories 148281 and 148282. No public exploit code exists and EPSS sits at 0.15% (5th percentile), indicating negligible observed exploitation pressure; the vulnerability is not listed in CISA KEV.
RemediationAI
Update iOS and iPadOS to version 26.6.1 and macOS Tahoe to version 26.6.2 via Settings > General > Software Update (iOS/iPadOS) or System Settings > General > Software Update (macOS). These are vendor-confirmed patched releases per Apple advisories at https://support.apple.com/en-us/148281 and https://support.apple.com/en-us/148282. No documented workarounds are provided by Apple. For users unable to update immediately, exercising caution with untrusted image sources - avoiding opening image attachments from unknown senders or browsing untrusted image-heavy sites - reduces but does not eliminate exposure, as the attack surface includes any image-processing pathway on the device. This compensating control has a meaningful usability trade-off on consumer devices.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-400 (Uncontrolled Resource Consumption) identifies the root cause as a failure to bound resource usage - likely memory, CPU cycles, or file handles - during image decoding within Apple's shared image processing stack. The vulnerability manifests across multiple Apple OS families, as confirmed by CPE strings cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:* and cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*. Apple's vague disclosure ('improved checks') is typical of their security notes and does not identify the specific image format or codec involved. The shared codebase across iOS/iPadOS and macOS Tahoe suggests a common image parsing library (potentially ImageIO or a lower-level codec) is the locus of the flaw.
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Crafted image delivered over network requires victim to open it (UI:R, AV:N); no attacker privileges needed (PR:N); impact is availability-only with no scope change (C:N/I:N/A:H/S:U).
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
The issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing an image may lead to a denial-of-service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB