IINA before 1

CVE-2026-47114 is an argument-injection bug in IINA's iina://open custom URL handler on macOS. In versions before 1.4.3, attacker-controlled mpv_ query parameters can reach mpv runtime options, and the dangerous confirmed path is mpv_options/input-commands=run, which can execute arbitrary commands as the currently logged-in user. The public advisory and vendor fix both point to the same browser-delivered flow: a malicious iina:// link, user approval of the browser protocol prompt, then command execution without needing a valid media file.

The vendor's HIGH 8.8 score is technically defensible in a lab because the impact is full user-context code execution from a remote lure. Operationally, though, this is not a broad enterprise emergency: it requires a macOS endpoint, IINA installed, a user click, a second user approval step, and it lands only in that user's session with no privilege escalation. That stack of friction materially narrows exposure, so the right call for fleet patching is MEDIUM, not HIGH.

Why this verdict

• Start from 8.8, then subtract for user friction: the vendor baseline assumes remote code execution impact, but the attack requires a browser-delivered lure and explicit approval of the iina:// handoff prompt.
• Population is naturally limited: only macOS devices with IINA installed are exposed. This is not Safari, Chrome, Office, or another near-universal enterprise app, so reachable population is materially smaller.
• Blast radius is one user session: execution is as the current macOS user. There is no sourced evidence of privilege escalation, cross-user compromise, or server-side multi-tenant impact.
• No exploitation evidence: not KEV-listed, no campaign reporting in sourced material, and the user-supplied EPSS is very low.

Why not higher?

Because this is not unauthenticated drive-by exploitation of an always-on service. The attack chain narrows hard at every stage: macOS only, IINA installed, user clicks, user approves protocol launch, then code runs only in that user's context. That is meaningful risk, but not a fleet-level HIGH absent exploitation pressure.

Why not lower?

Because once the chain succeeds, the attacker gets arbitrary command execution on the endpoint. This is not a cosmetic bug or a harmless crash; it is initial-access-grade code execution against the local user. Public PoC material exists, so defenders should not write it off as theoretical.

1. Block risky external-protocol launches from browsers — If your macOS browser management stack supports it, restrict or warn on handoff to non-business-critical custom URL schemes such as iina://. For a MEDIUM verdict there is no mitigation SLA; use the next normal policy cycle if patch rollout will lag, and keep the real patch inside the 365-day remediation window.
2. Hunt for IINA.app spawning shells or script engines — Create EDR analytics for parent IINA.app launching sh, bash, zsh, osascript, python, curl, or rm. This is the most practical compensating control because the exploit path eventually has to turn into a child process; for MEDIUM, there is no mitigation SLA, so deploy as standard detection engineering rather than emergency change.
3. Inventory IINA across managed Macs — Treat this as an application-specific exposure problem, not a generic macOS problem. Query MDM, EDR software inventory, or package receipts to identify hosts with IINA below 1.4.3; with a MEDIUM verdict there is no mitigation SLA, so this can run as routine hygiene while you plan remediation within 365 days.
4. Prefer allow-listed media players in managed environments — Where IINA is not business-required, standardize on approved software and remove niche user-installed players from managed fleets. This reduces future custom-protocol and plugin attack surface; again, MEDIUM means no mitigation SLA, so handle it through normal software governance.

Run this on the target macOS host or through your MDM/EDR remote shell. Invoke it as bash check_iina_cve_2026_47114.sh with no elevated privileges required for standard app locations; it checks common IINA install paths and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/bin/bash
# check_iina_cve_2026_47114.sh
# Detects whether installed IINA versions are vulnerable to CVE-2026-47114.
# Vulnerable: versions before 1.4.3
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET_VERSION="1.4.3"
FOUND_ANY=0
FOUND_VULN=0
FOUND_PATCHED=0

CANDIDATES=(
  "/Applications/IINA.app"
  "$HOME/Applications/IINA.app"
)

get_version() {
  local app="$1"
  local plist="$app/Contents/Info.plist"
  local version=""

  if [[ ! -f "$plist" ]]; then
    echo ""
    return 0
  fi

  version=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$plist" 2>/dev/null || true)
  if [[ -z "$version" ]]; then
    version=$(defaults read "${plist%.plist}" CFBundleShortVersionString 2>/dev/null || true)
  fi

  echo "$version"
}

# compare_versions a b
# returns:
#   0 if a == b
#   1 if a > b
#   2 if a < b
compare_versions() {
  local a="$1"
  local b="$2"
  local IFS=.
  local i
  local -a va vb

  read -r -a va <<< "$a"
  read -r -a vb <<< "$b"

  local len=${#va[@]}
  if [[ ${#vb[@]} -gt $len ]]; then
    len=${#vb[@]}
  fi

  for (( i=0; i<len; i++ )); do
    local ai=${va[i]:-0}
    local bi=${vb[i]:-0}

    # strip non-numeric suffixes conservatively
    ai=${ai%%[^0-9]*}
    bi=${bi%%[^0-9]*}
    [[ -z "$ai" ]] && ai=0
    [[ -z "$bi" ]] && bi=0

    if (( 10#$ai > 10#$bi )); then
      return 1
    elif (( 10#$ai < 10#$bi )); then
      return 2
    fi
  done

  return 0
}

for app in "${CANDIDATES[@]}"; do
  if [[ -d "$app" ]]; then
    FOUND_ANY=1
    version=$(get_version "$app")

    if [[ -z "$version" ]]; then
      continue
    fi

    compare_versions "$version" "$TARGET_VERSION"
    rc=$?

    if [[ $rc -eq 2 ]]; then
      FOUND_VULN=1
      echo "VULNERABLE"
      exit 1
    else
      FOUND_PATCHED=1
    fi
  fi
done

if [[ $FOUND_PATCHED -eq 1 ]]; then
  echo "PATCHED"
  exit 0
fi

if [[ $FOUND_ANY -eq 1 ]]; then
  echo "UNKNOWN"
  exit 2
fi

echo "UNKNOWN"
exit 2

Sources

1. NVD CVE-2026-47114
2. Official IINA 1.4.3 release note
3. GitHub issue #6083
4. Fix commit 1e6f432
5. GitHub release v1.4.3
6. Public advisory by stackpointer
7. CISA Known Exploited Vulnerabilities Catalog