Executive brief
A vulnerability exists in Apple's operating systems (including iOS, macOS, and watchOS) that can be triggered when the device processes a specially crafted media file. If a user opens such a file, it could cause an application to crash or allow for the corruption of system memory. This could potentially lead to unauthorized access to information or service disruptions on the affected device.
Technical details
An out-of-bounds access vulnerability (encompassing both CWE-125: Out-of-bounds Read and CWE-787: Out-of-bounds Write) exists across multiple Apple operating systems. The issue is rooted in insufficient bounds checking during the processing of media files. An attacker can exploit this by tricking a user into opening a maliciously crafted media file (User Interaction required). Successful exploitation can lead to unexpected application termination or process memory corruption. Apple has addressed this issue by improving bounds checking in the latest updates for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.
Affected products
- Apple iOS and iPadOS < 18.6
- Apple iPadOS < 17.7.9
- Apple macOS Sequoia < 15.6
- Apple macOS Sonoma < 14.7.7
- Apple macOS Ventura < 13.7.7
- Apple tvOS < 18.6
- Apple visionOS < 2.6
- Apple watchOS < 11.6
Timeline
- 2026-04-02: disclosed
- 2026-04-02: advisory