Product:
iOS, iPadOS, macOS, tvOS, visionOS, watchOS
Summary
The issue was addressed with improved bounds checks. Processing a maliciously crafted file may lead to unexpected app termination. This vulnerability affects multiple Apple operating systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.2 | CVE-2026-28977 |
Exploitation
To exploit this vulnerability, an attacker must create a maliciously crafted file and convince a user to process it on a vulnerable Apple device. This could lead to unexpected termination of the application, potentially allowing the attacker to disrupt services or gain further access.
Affected Products
- iOS 18.7.9 – Affected by the vulnerability leading to unexpected app termination.
- iPadOS 18.7.9 – Similar impact as iOS, with potential for app crashes.
- macOS Sequoia 15.7.7 – Vulnerable to the same issue, affecting application stability.
- macOS Sonoma 14.8.7 – Also impacted, leading to possible app termination.
- macOS Tahoe 26.5 – Affected by the vulnerability, causing unexpected behavior.
- tvOS 26.5 – Vulnerable, with potential for app crashes.
- visionOS 26.5 – Affected, leading to unexpected app termination.
- watchOS 26.5 – Vulnerable to the same issue, affecting app stability.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of the affected operating systems. Apple has released patches that address the issue, and applying these updates will help protect against potential exploitation.