Product:
watchOS, tvOS, macOS, iOS, iPadOS, visionOS
Summary
An out-of-bounds access issue was addressed with improved bounds checking. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory. This issue affects multiple Apple operating systems and has been fixed in the latest versions.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.1 | CVE-2026-20611 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious media file and convince a user to process it on a vulnerable device. This requires local access to the device and user interaction to trigger the processing of the file, which can lead to unexpected behavior or memory corruption.
Affected Products
- watchOS 26.3
- tvOS 26.3
- macOS Tahoe 26.3
- macOS Sonoma 14.8.4
- macOS Sequoia 15.7.4
- iOS 18.7.5
- iPadOS 18.7.5
- visionOS 26.3
- iOS 26.3
- iPadOS 26.3
Mitigation
Users are advised to update their devices to the latest versions of the affected operating systems to mitigate this vulnerability. Regularly applying security updates can help protect against potential exploits.