MacSec Labs identified a Heap Overflow in Apple's EXR Decoder: CVE-2026-28977. One overflow. One shared library. Flawed across iPhone, iPad, Mac at the same time, because they all ship the same decoder. No tap. No open. The victim does nothing. Here's how a single crafted image corrupts memory on every Apple platform This is the exact process we teach. Most Apple security training stops at macOS but MacSec Labs cover both MacOS and IOS. One platform for the full Apple attack surface. Our macOS and iOS vulnerability research tracks are built from 10+ years of real bounty hunting on Apple platforms and kernels, hands-on, current, and grounded in live findings like this one, not theory. Course: https://macseclabs.com/pricing Writeup: https://hxr1.ghost.io/heap-overflow-in-apples-exr-decoder/ #RedTeam #OffensiveSecurity #CyberSecurity #InfoSec #EthicalHacking #BugBounty #SecurityResearch #SecurityTraining
Post summary
The passage announces a heap overflow vulnerability in Apple's EXR Decoder, provides a detailed writeup describing the PoC without offering exploit code or patch information.