CVE-2026-43661

Buffer Overflow in Apple Image Processing Causes Memory Corruption

Published May 11, 2026 CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Description

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

Analysis

Technical impact

Apple’s image processing component can overflow a buffer when handling maliciously crafted images, allowing an attacker to corrupt process memory. This buffer overflow (CWE‑121) may cause crashes or unintended behavior. Apple addressed the issue with improved memory handling, releasing fixes in iOS 18.7.10, 26.5, 26.7; iPadOS 18.7.10, 26.5, 26.7; macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.5; tvOS 26.5; and watchOS 26.5.

Affected Systems

Apple iOS and iPadOS, Apple macOS (Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.5), Apple tvOS, and Apple watchOS are affected. Device firmware versions earlier than iOS 18.7.10, iOS 26.7, iPadOS 18.7.10, iPadOS 26.7, macOS releases earlier than Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.5, tvOS 26.5, and watchOS 26.5 contain the vulnerability, and the flaw has been addressed in the releases listed above.

Risk and Exploitability

The CVSS score is 7.5, indicating a high severity. The EPSS score of < 1% suggests that the probability of exploitation is currently very low, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious image file, so the likely attack vector is local, via email, messaging, or other file delivery channels. Because the flaw can corrupt process memory, it poses a significant risk if an attacker can convince a user to open the file.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.7.10
`0`	affected	< 26.5
`0`	affected	< 26.7

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 14.8.8
`0`	affected	< 15.7.8
`0`	affected	< 26.5

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

Vendor Product Versions

Apple

Ios And Ipados

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Apple

Macos

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Apple

Tvos

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Apple

Watchos

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the device to the latest Apple OS releases: iOS 18.7.10 or iOS 26.7, iPadOS 18.7.10 or iPadOS 26.7, macOS Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.5, and tvOS 26.5 and watchOS 26.5 or newer.
Apply any Apple security updates for all installed operating systems.
Until a patch is installed, avoid viewing or opening images from untrusted or unknown sources.

Generated by OpenCVE AI on September 21, 2026 at 09:06 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.3% (1.260% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://support.apple.com/en-us/127110
https://support.apple.com/en-us/127115
https://support.apple.com/en-us/127118
https://support.apple.com/en-us/127119
https://support.apple.com/en-us/128071
https://support.apple.com/en-us/128072
https://support.apple.com/en-us/148287
https://support.apple.com/en-us/149041

History

Sep 21, 2026 9:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Buffer Overflow in Apple Image Processing Causes Memory Corruption

Sep 14, 2026 9:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.	A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.
References		https://support.apple.com/en-us/149041

Aug 17, 2026 11:30 PM Title updated View changes

Type	Values Removed	Values Added
Title	Apple Image Processing Buffer Overflow

Aug 17, 2026 9:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.	A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.
References		https://support.apple.com/en-us/148287

Jul 30, 2026 12:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		Apple Image Processing Buffer Overflow

Jul 27, 2026 8:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.	A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.
References		https://support.apple.com/en-us/128071 https://support.apple.com/en-us/128072

May 12, 2026 6:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple ipados Apple iphone Os
CPEs		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:tvos:::::::: cpe:2.3:o:apple:watchos::::::::
Vendors & Products		Apple ipados Apple iphone Os

May 12, 2026 5:00 PM Title updated View changes

Type	Values Removed	Values Added
Title	Buffer Overflow via Malicious Image Processing Leading to Memory Corruption

May 12, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 11, 2026 11:00 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Buffer Overflow via Malicious Image Processing Leading to Memory Corruption
Weaknesses		CWE-121

May 11, 2026 10:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos Apple tvos Apple watchos
Vendors & Products		Apple Apple ios And Ipados Apple macos Apple tvos Apple watchos

May 11, 2026 8:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.
References		https://support.apple.com/en-us/127110 https://support.apple.com/en-us/127115 https://support.apple.com/en-us/127118 https://support.apple.com/en-us/127119