CVE-2026-28941

The vulnerability stems from insufficient bounds checking when processing maliciously crafted files. An out-of-bounds read can occur, leading to potential system instability or memory disclosure [1][2][3].

To exploit the vulnerability, an attacker would need to deliver a specially crafted file to the target system, such as through email or web download. User interaction is likely required to open or process the file.

Successful exploitation may cause the affected application or system to crash, resulting in a denial-of-service condition. Additionally, memory contents could be disclosed, potentially exposing sensitive information.

Apple has addressed the issue in iOS 18.7.9, iPadOS 18.7.9, macOS Sequoia 15.7.7, and macOS Tahoe 26.5. Users are advised to update their devices as soon as possible [1][2][3].