EUVD-2026-110122
GHSA-c5g5-gx5j-fp5x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted image to victim
-
ExploitUser or service processes image
-
ExecutionTrigger buffer overflow in image handling
-
ImpactProcess terminates unexpectedly (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to process an attacker-supplied, maliciously crafted image using macOS image handling, so success is gated on user interaction (UI:R) - the image must be opened, previewed, or otherwise processed. The specific image format, parser, or API that triggers the overflow is not described in the available sources. Affected deployments are macOS versions prior to Golden Gate 27.2, Sequoia 15.8.2, and Tahoe 26.7.2; patched systems are not exploitable. The realistic ceiling on impact is a crash/denial of service of the processing component - the description and CVSS indicate no confidentiality or integrity consequence and no privilege gain. |
| Impact | This is a genuinely low-priority issue despite being a 'buffer overflow' (CWE-119). All signals converge on limited real-world risk rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, base 4.3) scores availability-only impact - the description confirms the outcome is 'unexpected process termination' (a crash/DoS), with no confidentiality or integrity impact and no evidence of code execution. User interaction is required (UI:R), meaning a victim must process the malicious image. EPSS is low at 0.48% (41st percentile), consistent with the SSVC decision (Exploitation: none, Automatable: no, Technical Impact: partial). There is no CISA KEV listing and no public exploit reference in the input. The vuln.today decision label is 'this_month,' which aligns with a patch-available, low-severity, non-exploited issue - not an emergency. No signals conflict here: a network-deliverable but interaction-gated, crash-only flaw in a widely deployed OS is appropriately treated as routine patching rather than urgent response. |
| Exploit ScenarioDerived | An attacker crafts a malicious image file and delivers it to a victim via email, a website, or a messaging app so that macOS image-processing code handles it. When the user opens or the system processes the image, a buffer overflow causes the responsible process to terminate unexpectedly (a denial-of-service outcome). No public exploit code is identified in the available data, and the flaw yields no confidentiality or integrity impact. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Image handling on unpatched Apple macOS releases can be driven into a buffer overflow that terminates the processing process, giving a denial-of-service outcome with no confidentiality or integrity impact. The flaw is addressed by improved bounds checking in macOS Golden Gate 27.2, macOS Sequoia 15.8.2 and macOS Tahoe 26.7.2, so only systems below those builds are exposed; exploitation requires the victim to process an attacker-supplied maliciously crafted image (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, 4.3). No public exploit identified at time of analysis, SSVC records no known exploitation and EPSS is 0.48% (41st percentile), making this a this-month, low-urgency patch item rather than an emergency.
RemediationAI
Vendor-released patch: upgrade to macOS Golden Gate 27.2, macOS Sequoia 15.8.2, or macOS Tahoe 26.7.2 according to the branch in use; these are the versions Apple names as fixed, and each is documented in the corresponding advisory (https://support.apple.com/en-us/149521, https://support.apple.com/en-us/149522, https://support.apple.com/en-us/149523). No alternative mitigation, configuration change or feature disablement is stated in the available sources - the vendor's guidance is to update. Given the required user interaction (the victim must process the crafted image) and the availability-only impact, patching can follow normal monthly maintenance cadence, consistent with the this_month priority label, without emergency change pressure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-119 (improper restriction of operations within the bounds of a memory buffer), and Apple's fix note attributes the correction to improved bounds checking, meaning one or more length or offset values derived from image content were not adequately validated before being used in a memory operation. The affected code is macOS image handling, but the specific image format, parser, framework or API that reaches the overflow is not described in the available sources. CPE data identifies the affected platform generically as cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* with no component-level granularity. The CVSS vector is network-reachable (AV:N) and needs no privileges (PR:N) but requires user interaction (UI:R), which matches the deployment reality that the crafted image must be opened, previewed or otherwise processed by the target. Scope is unchanged and the only scored impact is availability (A:L), consistent with an out-of-bounds memory error whose observable effect is process termination rather than code execution or data exposure. No CWE or advisory text in the supplied data indicates a path to memory corruption exploitation beyond the crash.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
A malicious image can be delivered over the network (AV:N) but requires the victim to process it (UI:R); no auth needed (PR:N); impact is a crash only, so C:N/I:N/A:L.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may lead to unexpected process termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB