Viber for iOS: Denial of service via malformed GIF
Summary
Viber for iOS through version 29.4.0.24 does not validate the logical screen width and height of received GIF files. An attacker can send a crafted GIF with zero dimensions, which triggers an uncaught exception and aborts the app when the image is opened. The attack is remote and needs no login, but the impact is limited to crashing the app, with no reported data loss or code execution.
Affected
- Viber for iOS, versions 0 through 29.4.0.24
Fixed in
- Unknown. No fixed version or vendor advisory has been published yet.
Workaround
- Unknown. No user-side workaround has been confirmed. The source-level mitigation (minimum width and height checks) applies to developers only.
Exploitation
- Not known to be exploited in the wild. CISA KEV: No.
- A public exploit listing exists (Sploitus, advisory ID ZSL-2026-6039). It describes a remote one-tap crash and was not verified by us. One aggregator reports no public PoC.
Our recommendation
- Keep Viber updated through the App Store and check for a newer build than 29.4.0.24 once a fix is published.
- On managed iPhones, verify via MDM that Viber is current.
- For devices where Viber is business-critical, consider restricting its use until a fix is confirmed.
- Re-check the vendor advisory and the App Store release notes regularly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-126546 www.cve.org
- VulnCheck Advisory www.vulncheck.com
- Zero Science Advisory ZSL-2026-6039 www.zeroscience.mk
- Viber www.viber.com
- Sploitus PoC listing ZSL-2026-6039 sploitus.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:13.
Original description (NVD)
Viber for iOS through 29.4.0.24 fails to validate the logical screen width and height in received GIF headers, allowing attackers to crash the app. Attackers can send a crafted GIF with zero dimensions that triggers an uncaught NSInternalInconsistencyException, aborting the app with SIGABRT when opened.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.