Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D model may lead to memory corruption.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-14T21:17:36.240Z",
  "pubdate": "2026-09-14T21:17:36.240Z",
  "executiveSummary": "This vulnerability is an out-of-bounds write issue affecting multiple Apple operating systems, including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.\nThe flaw resides within the processing logic for 3D model files, which lacks adequate bounds checking during the parsing phase.\nA remote or local attacker can exploit this by providing a maliciously crafted 3D model, leading to memory corruption.\nSuccessful exploitation may result in arbitrary code execution, application crashes, or unauthorized access to system memory, depending on the context of the vulnerable component.\nThis vulnerability presents a significant security risk, as the exploitation requirement is limited to the processing of a specific file format, which could be embedded in various media or web content.\nAffected products include iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.",
  "technicalDetails": "The vulnerability is a memory safety issue categorized as an out-of-bounds (OOB) write. The root cause is insufficient validation of input data dimensions and buffer offsets when parsing 3D model files.\nWhen the system component responsible for rendering or processing 3D data encounters a maliciously crafted file, it performs write operations to memory locations outside the intended allocation boundaries of a heap-based or stack-based buffer.\nThe attack flow initiates when a victim opens or interacts with an attacker-supplied 3D model. The parsing engine, expecting structured data, processes malformed geometry definitions or metadata that explicitly bypass standard length checks.\nBecause the bounds checking mechanism is flawed, the parsing engine calculates an incorrect destination address for writing pixel data, vertex arrays, or structural headers. This allows the attacker to overwrite adjacent memory structures, which may include function pointers, object vtables, or sensitive heap metadata.\nBy controlling the contents of the overflow, an attacker can influence the execution flow of the application. For instance, overwriting a return address or a vtable pointer facilitates control over the instruction pointer, leading to arbitrary code execution within the security context of the user or the rendering process.\nThe vulnerability affects several Apple OS versions: iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.\nExploitation does not typically require prior authentication or elevated privileges, provided the attacker can convince a user to interact with the malicious asset. The network exposure is determined by the vector through which the 3D model is delivered, such as a malicious website, email attachment, or compromised cloud-hosted asset.\nPost-exploitation impact includes full compromise of the application process's data, potential escalation to broader system privileges if the rendering process has high-level permissions, and long-term persistence if the attacker achieves code execution through the memory corruption primitive."
}