Executive brief
A vulnerability in Apple's operating systems could allow a malicious file to crash an application. This occurs when the system's symbolication component, which helps translate technical data into readable information, fails to properly check the boundaries of a file it is reading. An exploit could lead to service interruptions or unexpected application shutdowns, potentially impacting productivity and system stability.
Technical details
An out-of-bounds access vulnerability exists in the CoreSymbolication component of Apple's operating systems. The root cause is insufficient bounds checking during the parsing of specially crafted files. An attacker can exploit this by providing a malicious file to be processed by the system, leading to an out-of-bounds read or write that results in application termination (Denial of Service). The issue was addressed in the May 2026 updates by implementing improved bounds checking. Affected platforms include iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.
Affected products
- Apple iOS Before 26.5
- Apple iPadOS Before 26.5
- Apple macOS Tahoe Before 26.5
- Apple tvOS Before 26.5
- Apple visionOS Before 26.5
- Apple watchOS Before 26.5
Timeline
- 2026-05-11: disclosed
- 2026-05-11: patched