CVE-2026-28990

HIGH

iOS and iPadOS < 26.5 - Memory Corruption via Maliciously Crafted Image

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-28990. PoCs published by Billy-Ellis.

AI-analyzed exploit summary This repository contains a functional PoC for CVE-2026-28990, an integer overflow vulnerability in ImageIO's EXRReadPlugin::decodeBlockAppleEXR function on iOS/macOS 26.4.2. The exploit generates a crafted EXR file that triggers memory corruption via a heap overflow when processed by the vulnerable ImageIO library.

Description

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

Exploits (1)

github WORKING POC 36 stars
by Billy-Ellis · pythonpoc
https://github.com/Billy-Ellis/exr-imageio-poc

This repository contains a functional PoC for CVE-2026-28990, an integer overflow vulnerability in ImageIO's EXRReadPlugin::decodeBlockAppleEXR function on iOS/macOS 26.4.2. The exploit generates a crafted EXR file that triggers memory corruption via a heap overflow when processed by the vulnerable ImageIO library.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: ImageIO on iOS/macOS 26.4.2
No auth needed
Prerequisites: Python 3 · numpy · target system running iOS/macOS 26.4.2
devstral-2 · analyzed Jun 03, 2026 Full analysis →

Scores

CVSS v3 7.5
EPSS 0.0035
EPSS Percentile 27.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-119
Status published
Products (13)
Apple/iOS and iPadOS < 26.5
apple/ipados < 26.5
apple/iphone_os < 26.5
Apple/macOS < 14.8.7
Apple/macOS < 15.7.7
Apple/macOS < 26.5
apple/macos 14.0 - 14.8.7
Apple/tvOS < 26.5
apple/tvos < 26.5
Apple/visionOS < 26.5
... and 3 more
Published May 11, 2026
Tracked Since May 12, 2026