Apple macOS/watchOS/visionOS/iOS/iPadOS/tvOS up to 26.2 Media File out-of-bounds

Summaryinfo

A vulnerability was found in Apple macOS, watchOS, visionOS, iOS, iPadOS and tvOS up to 26.2. It has been rated as critical. Affected by this issue is some unknown functionality of the component Media File Handler. This manipulation causes out-of-bounds. The identification of this vulnerability is CVE-2026-20611. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in Apple macOS, watchOS, visionOS, iOS, iPadOS and tvOS up to 26.2. Affected by this vulnerability is an unknown function of the component Media File Handler. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, macOS Sequoia 15.7.4, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.

The advisory is shared at support.apple.com. This vulnerability is known as CVE-2026-20611 since 11/11/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 03/16/2026).

The vulnerability scanner Nessus provides a plugin with the ID 298657 (macOS 15.x < 15.7.4 Multiple Vulnerabilities (126349)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 26.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (298657). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Smartwatch Operating System

Vendor

• Apple

Name

• iOS
• iPadOS
• macOS
• tvOS
• visionOS
• watchOS

Version

• 26.0
• 26.1
• 26.2

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion