Description
The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. Processing a maliciously crafted file may lead to unexpected app termination.
Published: 2026-05-11
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An attacker can supply a malicious file that causes an application crash in affected Apple operating systems. The vulnerability stems from insufficient validation of file input, leading to an unexpected termination of the application. This results in a denial of service for users of the affected software and does not arbitrary code execution or privilege escalation.

Affected Systems

Apple’s iOS, iPadOS, macOS Sonoma, macOS Tahoe, and visionOS are affected. Vulnerable releases include iOS 18.7.8 and earlier, iPadOS 18.7.8 and earlier, iOS 26.4 and earlier, iPadOS 26.4 and earlier, macOS Sonoma 14.8.6 and earlier, macOS Tahoe 26.4 and earlier, and visionOS 26.4 and earlier; the releases iOS 18.7.9+, iPadOS 18.7.9+, iOS 26.5+, iPadOS 26.5+, macOS Sonoma 14.8.7+, macOS Tahoe 26.5+, and visionOS 26.5+ include the fix.

Risk and Exploitability

The CVSS score of 7.5 signals high severity, while an EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog and no public exploits are known. Attackers would need to deliver or prompt a user to open a malicious file; no network-based entry is required. The failure occurs during file parsing, causing the application to crash.

Generated by OpenCVE AI on May 13, 2026 at 20:01 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to the latest OS releases (iOS 18.7.9+, iPadOS 18.7.9+, macOS Sonoma 14.8.7+, macOS Tahoe 26.5+, visionOS 26.5+).
  • Avoid opening or executing files from untrusted or unknown sources until the OS has been updated.
  • Monitor applications for unexplained crashes and apply any subsequent security updates promptly.

Generated by OpenCVE AI on May 13, 2026 at 20:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 14 May 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Wed, 13 May 2026 20:30:00 +0000

Type Values Removed Values Added
Title Malicious File Causes App Crash on Apple OS Leading to Denial of Service

Wed, 13 May 2026 18:15:00 +0000

Type Values Removed Values Added
Title Malicious File Causing Unexpected App Termination
Weaknesses CWE-665

Wed, 13 May 2026 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 11 May 2026 22:15:00 +0000

Type Values Removed Values Added
Title Malicious File Causing Unexpected App Termination
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple visionos
Weaknesses CWE-665
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple visionos

Mon, 11 May 2026 20:45:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. Processing a maliciously crafted file may lead to unexpected app termination.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Visionos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-05-13T13:15:09.860Z

Reserved: 2026-03-03T16:36:03.989Z

Link: CVE-2026-28936

cve-icon Vulnrichment

Updated: 2026-05-13T13:12:39.067Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-11T21:18:55.123

Modified: 2026-05-14T14:01:24.020

Link: CVE-2026-28936

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-13T20:15:04Z

Weaknesses
  • CWE-20

    Improper Input Validation