CVE-2026-107335

Vendor

Apple

Product

ImageMagick / Ghostscript / FFmpeg / libxml2

CVSS

6.5

EPSS

0.010 (p62)

Exposure class

Mobile OS

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 21
   CISA advisory CISA 16d ago

   CISA Malcolm

   The following versions of CISA Malcolm are affected: Malcolm Malcolm CVSS Vendor Equipment v3 8.1 CISA Malcolm 6 Vulnerabilities Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF)…

   CVSS 3.1 CVE-2026-107336CVE-2026-107333CVE-2026-107362+4 more Apple
2. 9
   CVE NVD 23d ago

   Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when…

   Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not…

   CVSS 6.5 CVE-2026-107335