Critical Remote Code Execution in Apple macOS libusd_ms (CVE-2026-20616) via Alembic File Parsing
What It Is — A newly disclosed out‑of‑bounds write flaw in the libusd_ms library that parses Alembic files on macOS. The bug allows an attacker to execute arbitrary code in the context of the current process.
Exploitability — Exploitation requires a malicious Alembic file to be written to the local filesystem and opened by a user (user‑interaction required). No public PoC is known, but the vulnerability carries a CVSS 7.8 (High) score and Apple has released a patch.
Affected Products — Apple macOS (all supported releases at the time of advisory).
TPRM Impact — Any organization that uses macOS workstations, development environments, or relies on third‑party vendors that deliver macOS‑based tools faces endpoint compromise risk, which can cascade through the supply chain and expose sensitive corporate data.
Recommended Actions —
- Apply Apple’s security update (KB 126350) without delay.
- Implement application‑control or file‑blocking policies to prevent unknown Alembic files from being opened.
- Enable endpoint detection and response (EDR) monitoring for anomalous
libusd_msactivity. - Verify that all macOS‑based third‑party providers have patched the vulnerability.
- Conduct a rapid risk assessment of any recent file exchanges that may have included Alembic files.