CVE-2015-5926

Vulnerability

A memory corruption vulnerability exists in the CoreGraphics component of Apple iOS (versions prior to 9.1), OS X (versions prior to 10.11.1, including Mavericks 10.9.5 and Yosemite 10.10.5), and watchOS (versions prior to 2.0.1). The flaw can be triggered when processing maliciously crafted web content, leading to memory corruption.

Exploitation

An attacker can exploit this vulnerability by hosting a malicious website and luring a user to visit it. No authentication or special privileges are required. When the user's browser renders the crafted content, the CoreGraphics component mishandles the data, causing memory corruption.

Impact

Successful exploitation allows an attacker to execute arbitrary code or cause a denial of service (memory corruption). Code execution occurs within the context of the affected application (e.g., Safari or other WebKit-based browser), potentially leading to full system compromise if combined with other vulnerabilities.

Mitigation

Apple addressed this issue in iOS 9.1 [2], OS X El Capitan 10.11.1, Security Update 2015-004 Yosemite, and Security Update 2015-007 Mavericks [1], and watchOS 2.0.1 [3]. Users should update their devices to the latest available versions. No workarounds are documented.