Product:
iOS, iPadOS, macOS, tvOS, visionOS, watchOS
Summary
A memory corruption issue was addressed with improved input validation. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory. This issue is fixed in the latest versions of the affected products.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2026-28956 |
Exploitation
An attacker can exploit this vulnerability by crafting a malicious media file and convincing a user to open it on a vulnerable device. The exploitation requires user interaction, as the user must open the file for the attack to succeed. Once the file is processed, it may lead to unexpected behavior or termination of the application.
Affected Products
- iOS 26.5: Latest version addressing the memory corruption issue.
- iPadOS 26.5: Updated to fix the vulnerability.
- macOS Sequoia 15.7.7: Includes the necessary security improvements.
- macOS Sonoma 14.8.7: Patched to prevent exploitation.
- macOS Tahoe 26.5: Updated to mitigate the issue.
- tvOS 26.5: Fixed to enhance security against the vulnerability.
- visionOS 26.5: Addressed the memory corruption issue.
- watchOS 26.5: Updated to improve input validation.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of the affected products. Regularly applying software updates can help protect against known vulnerabilities and improve overall security.