Product:
iOS, iPadOS, macOS, visionOS
Summary
An out-of-bounds write issue was addressed with improved bounds checking. This issue may lead to unexpected app termination when processing a maliciously crafted USD file. The issue has been fixed in the latest versions of iOS, iPadOS, macOS Tahoe, macOS Sonoma, and visionOS.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2026-20616 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious USD file and convince a user to open it on a vulnerable device. The attack requires local access to the device and user interaction to trigger the processing of the malicious file, which can lead to unexpected termination of the application.
Affected Products
- iOS 18.7.5 – Latest version addressing the vulnerability.
- iPadOS 18.7.5 – Latest version addressing the vulnerability.
- macOS Tahoe 26.3 – Latest version addressing the vulnerability.
- macOS Sonoma 14.8.4 – Latest version addressing the vulnerability.
- visionOS 26.3 – Latest version addressing the vulnerability.
Mitigation
Users are advised to update their devices to the latest versions of iOS, iPadOS, macOS, and visionOS to mitigate the risk associated with this vulnerability. Regularly updating software can help protect against known vulnerabilities.