Denial of Service Vulnerability in Viber for iOS by Viber
CVE-2026-126546

5.3MEDIUM

Key Information:

Vendor

Rakuten Viber

Status
Viber For iOS
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126546?

Viber for iOS versions up to 29.4.0.24 is susceptible to a denial of service attack due to improper validation of GIF header dimensions. An attacker can exploit this vulnerability by sending a specially crafted GIF image with zero dimensions, resulting in an uncaught NSInternalInconsistencyException. This exception causes the app to terminate unexpectedly with a SIGABRT signal when the image is opened, leading to potential disruptions and user experience issues.

Affected Version(s)

Viber for iOS 0 <= 29.4.0.24

References

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-60...
third-party-advisory
https://www.viber.com
product
https://www.vulncheck.com/advisories/viber-for-ios-throug...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gjoko Krstic
.