CVE-2026-84526

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D scene may lead to...

CVE-2026-84526

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D scene may lead to...

EUVD-2026-78045

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D scene may lead to...

CVE-2026-84526

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D scene may lead to...

CVE-2026-84526

Apple has addressed an out-of-bounds write vulnerability that can be triggered by processing a maliciously crafted 3D scene . This flaw may result in unexpected process termination . The issue is resolved in iOS 26.7 , iPadOS 26.7 , iOS 27 , iPadOS 27 , macOS Golden Gate 27 , macOS Sequoia 15.8 ,...

CVE-2026-90793

A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gfnodegetname of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may be performed from remote. The exploit has been disclosed to the public and may b...

CVE-2026-90609

A vulnerability has been found in GPAC up to f1219cde. The impacted element is an unknown function of the file scenegraph/vrmltools.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been...

EUVD-2026-77167

A vulnerability was identified in GPAC up to f1219cde. Affected is the function gfsmdumpcommandlist of the file scenemanager/scenedump.c of the component MP4Box. The manipulation leads to reachable assertion. The attack must be carried out locally. The exploit is publicly available and might be...

PT-2026-91003

A vulnerability was determined in GPAC up to f1219cde. This impacts the function xmt parse element of the file scene manager/loader xmt.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. The attack is restricted to local execution. The exploit has been publicly...

CVE-2026-84526: Out-of-bounds Write

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D scene may lead to...

PT-2026-91004

A vulnerability was identified in GPAC up to f1219cde. Affected is the function gf sm dump command list of the file scene manager/scene dump.c of the component MP4Box. The manipulation leads to reachable assertion. The attack must be carried out locally. The exploit is publicly available and migh...

ROS-20260914-73-0001

The vulnerability of the loadxmtrun function in the MP4Box multimedia platform’s utility software, related to the use of memory after its release during processing an incorrect XMT scene, allows a intruder to cause a service failure...

PT-2026-91590

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D scene may lead to...

ROS-20260911-73-0018

The vulnerability of the gfnodetryDestroy function in the MP4Box multimedia platform of GPAC, related to the use of memory after its release during processing of an incorrect XMT scene, allows a violator to cause a service failure...

ROS-20260911-73-0007

The vulnerability of the xmtresolveodlinks function in the MP4Box utility of the GPAC multimedia platform, which stems from the use of memory after it is freed during processing an incorrect XMT scene, allows a perpetrator to cause a service failure...

ROS-20260911-73-0016

The vulnerability of the gfnodeunregister function in the MP4Box utility of the GPAC multimedia platform arises from the use of memory after it is freed during the processing of an incorrect XMT scene. This vulnerability allows a malicious actor to cause a service failure...

ROS-20260911-73-0001

The vulnerability of the InputSensorModified function in the MP4Box utility of the GPAC multimedia platform, which involves swapping the zero pointer during processing of an incorrect XMT scene, allows a violator to trigger a service failure...

ROS-20260911-73-0005

The vulnerability of the gfsgcommanddel function in the MP4Box utility of the GPAC multimedia platform arises from the use of memory after it is freed during the processing of an incorrect XMT scene. This vulnerability allows a malicious actor to cause a service failure...

ROS-20260911-73-0014

The vulnerability of the xmtnodestart function in the MP4Box utility of the GPAC multimedia platform, related to the use of memory after its release during processing an incorrect XMT scene, allows a violator to trigger a service failure...

ROS-20260911-73-0017

The vulnerability of the gfsgcommanddel function in the MP4Box utility of the GPAC multimedia platform arises from the use of memory after it is freed during the processing of an incorrect XMT scene. This vulnerability allows a malicious actor to cause a service failure...