Security experts are warning of a new zero-day vulnerability affecting Apple's QuickTime and iTunes players.
Known as a 'boundary condition error', the flaw exists in the player's handling of header information for multimedia files. An attacker could place specially-crafted XML code within an audio or movie file and cause the application to crash.
Discovery of the flaw was credited to a researcher using the handle 'securfrog'. There have been no reports of the vulnerability being targeted in the wild.
It is not yet known whether the crash would also allow for the remote execution of code on the target machine. The vulnerability exists in both the MacOS and Windows versions of the QuickTime 7.5.5 player and iTunes 8.0.
Security firm Intego is currently classifying the vulnerability as a low-risk flaw, though the danger from attack could increase significantly should remote code execution be found possible.
News of the vulnerability comes just days after Apple released major updates for both QuickTime and iTunes. In addition to new features, the updates contained numerous security patches.
QuickTime zero-day spotted
Flaw also affects latest iTunes.
Add iTnews as your trusted source
Got a news tip for our journalists? Share it with us anonymously here.
Partner Content
.jpg&h=140&w=231&c=1&s=0)
Partner Content
Who owns your brand’s AI reputation?
.jpg&h=140&w=231&c=1&s=0)
Partner Content
From data overload to decisive action – accelerating decisions with AI agents
iTnews State of Security Breakfast comes to Sydney
.jpg&h=140&w=231&c=1&s=0)
Promoted Content
Protecting the Human Operating System: How Technology Teams Can Perform Under Pressure in an Always-On World
SPONSORED RESOURCES
Closing the cyber security execution gap: How IT leaders are building cyber resilience
Tech Skills Report
Rethinking Ransomware Recovery: Closing the Detection and Recovery Gap in Asia Pacific
Strategies to Counter the Ransomware Threat in APJ
Craft your ideal hybrid multicloud strategy
Cloud Resilience Summit
iTnews Benchmark Security Awards 2026
iTnews State of Security Breakfast Sydney
iTnews Executive Retreat - Security Leaders Edition - VIC
