Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-4632: Apple iOS, macOS, tvOS, watchOS can crash from image handling

CVE-2016-4632 · published 10 years ago

Summary

The image processing component in iOS versions before 9.3.3, macOS before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 can be forced to use excessive memory, causing the device to become unresponsive. This can happen when a maliciously crafted image is opened. Update the operating system to the latest version to prevent the issue.

What to do

Update apple iphone_os to version 9.3.3 or later.
Update apple mac_os_x to version 10.11.6 or later.
Update apple tvos to version 9.2.2 or later.
Update apple watchos to version 2.2.2 or later.

Affected software

Vendor	Product	Affected versions
apple	iphone_os	< 9.3.3 `cpe:2.3:o:apple:iphone_os::::::::`
apple	mac_os_x	< 10.11.6 `cpe:2.3:o:apple:mac_os_x::::::::`
apple	tvos	< 9.2.2 `cpe:2.3:o:apple:tvos::::::::`
apple	watchos	< 2.2.2 `cpe:2.3:o:apple:watchos::::::::`

Original advisory text

ImageIO in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.

References

http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html Mailing List Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html Mailing List Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html Mailing List Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html Mailing List Vendor Advisory
http://www.securityfocus.com/bid/91834 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1036344 Third Party Advisory VDB Entry
https://support.apple.com/HT206902 Vendor Advisory
https://support.apple.com/HT206903 Vendor Advisory
https://support.apple.com/HT206904 Vendor Advisory
https://support.apple.com/HT206905 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

3% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published22 Jul 2016

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2016-4632 · NVD

Track software like this

Free during beta