ZDI 2026-03-10

ZDI-26-176: Apple macOS libusd_ms Alembic File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

CVE-2026-20616

Machine-generated analysis · WAYSCloud LLM

The vulnerability involves an out-of-bounds write in libusd_ms during Alembic file parsing, requiring user interaction to trigger via a malicious file.

Context

The affected component is libusd_ms in Apple macOS, which handles Alembic file parsing. The vulnerability is an out-of-bounds write that can lead to remote code execution. User interaction is required, as the attacker must deliver a malicious file to the target's filesystem. The ZDI assigned a CVSS score of 7.8, indicating a medium to high severity impact.

Operator considerations

Check: Identify systems running Apple macOS that may process Alembic files through applications linked to libusd_ms.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. User interaction is required to exploit this vulnerability in that the target must receive a malicious file that is written to the local filesystem. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-20616.

Read the full advisory on ZDI →