CVE-2025-46316
BaseFortify
Publication date: 2026-01-28
Last updated on: 2026-04-02
Assigner: Apple Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apple | pages | to 15.1 (exc) |
| apple | ipados | to 26.1 (exc) |
| apple | iphone_os | to 26.1 (exc) |
| apple | macos | to 26.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an out-of-bounds read caused by insufficient input validation when processing a maliciously crafted Pages document. It can lead to unexpected termination of the application or disclosure of process memory.
How can this vulnerability impact me? :
Exploitation of this vulnerability may cause the affected application to crash unexpectedly or potentially leak sensitive process memory, which could be used to gain information about the system or application state.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update affected Apple products to the fixed versions: iOS 26.1, iPadOS 26.1, Pages 15.1, and macOS Tahoe 26.1. Avoid opening maliciously crafted Pages documents until the update is applied.