The issue was addressed with improved bounds checks. This issue is fixed in macOS Tahoe 26, Keynote 15.1, iOS 26 and iPadOS 26. Processing a maliciously crafted Keynote file may disclose memory contents.
2026-01-28T18:16:49.213
2026-01-30T16:48:55.903
Analyzed
CVSSv3.1: 5.5 (MEDIUM)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | apple | keynote | < 15.1 | Yes |
| Operating System | apple | ipados | < 26.0 | Yes |
| Operating System | apple | iphone_os | < 26.0 | Yes |
| Operating System | apple | macos | < 26.0 | Yes |