EUVD-2026-29215
GHSA-5xgr-7873-hpc7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Local app execution (AV:L, PR:L) triggers kernel code execution, constituting scope change (S:C) with full system impact (C:H/I:H/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to execute arbitrary code with kernel privileges.
AnalysisAI
Out-of-bounds write in Apple iOS/iPadOS and macOS allows a malicious app to execute arbitrary code with kernel privileges, representing a local privilege escalation to the highest system level. Affected platforms include iOS and iPadOS prior to 18.7.9, macOS Sonoma prior to 14.8.7, macOS Sequoia prior to 15.7.7, and macOS Tahoe prior to 26.5. No public exploit code has been identified and CISA has not listed this in KEV, but kernel-level code execution represents severe potential impact if triggered.
Technical ContextAI
CWE-787 (Out-of-Bounds Write) is a memory safety flaw where a component writes data past the allocated buffer boundary, corrupting adjacent memory. On Apple platforms this class of bug frequently occurs in kernel extensions or XNU kernel subsystems. Exploitation enables an attacker-controlled app to overwrite kernel data structures, potentially hijacking control flow to gain ring-0 (kernel) code execution. Affected CPEs are cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:* and cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, spanning the iOS 18.x and macOS 14/15/26 release trains. Apple addressed the flaw with improved bounds checking, a standard mitigation for this CWE class.
RemediationAI
Vendor-released patches are available: update iOS and iPadOS to 18.7.9, macOS Sonoma to 14.8.7, macOS Sequoia to 15.7.7, or macOS Tahoe to 26.5 via standard Apple Software Update mechanisms. These updates are detailed in Apple's security advisories at https://support.apple.com/en-us/127111 through https://support.apple.com/en-us/127117. If immediate patching is not feasible, restrict device usage to trusted App Store applications only and avoid sideloading or installing provisioning profiles from untrusted sources, as exploitation requires a malicious app to run on the device. Enterprise MDM deployments should prioritize this update in their patch cadence given the kernel-level impact.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today