EUVD-2026-77856
GHSA-wfgf-q454-5qjc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious low-privilege app
-
DeliveryApp sends crafted input to vulnerable kernel path
-
ExploitTrigger out-of-bounds write in kernel
-
ExecutionCorrupt kernel memory
-
ImpactSystem termination or privilege escalation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to run a locally-installed app on the device (PR:L, AV:L) that can reach the vulnerable kernel code path; no user interaction is needed once the app runs (UI:N). Exploitation is limited by the need for prior local app execution - there is no remote or network vector - and by the affected-version window (systems earlier than iOS/iPadOS 26.7 & 27, macOS Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, tvOS 27, visionOS 27, watchOS 27). No special non-default configuration is required; any unpatched device running a malicious app is exposed. |
| Impact | This is a locally-exploitable kernel-level memory-corruption flaw with modest real-world urgency. The vendor CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) confirms it requires a locally-installed, already-running app with low privileges - not remote or unauthenticated access - which sharply limits mass-exploitation potential. EPSS is low (0.21%, 11th percentile) and there is no CISA KEV listing and no public exploit identified, so this is not an active-exploitation priority. HOWEVER, the vendor scored impact as C:N/I:N/A:H (availability-only), which UNDERSTATES the threat: the description explicitly says an app may 'corrupt kernel memory,' which is an integrity impact and a classic privilege-escalation/jailbreak primitive rather than a mere crash - Apple kernel OOB writes are routinely chained into full kernel R/W. Also note the CWE is CWE-125 (out-of-bounds READ) while the description states an out-of-bounds WRITE - these conflict, and the write is the more severe and description-supported classification (CWE-787). Bottom line: patch-priority, not emergency; more dangerous than the 5.5 base score suggests because kernel-memory corruption enables local privilege escalation. |
| Exploit ScenarioDerived | A user installs a malicious or compromised app from a sandboxed context; the app feeds crafted input to a vulnerable kernel code path that performs an out-of-bounds write, corrupting kernel memory. The attacker either crashes the device (unexpected system termination / DoS) or grooms kernel memory to build a privilege-escalation primitive that breaks out of the app sandbox. No public exploit is identified at time of analysis, and exploitation requires the attacker to already have code execution in a local app. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Kernel memory corruption in Apple's operating systems lets an app running on the device crash the system or corrupt kernel memory, with the independent assessment scoring integrity and availability impact as High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). Every unpatched device is exposed once a user launches a malicious or compromised app: no network vector, no user interaction beyond app execution, and no special configuration is required. There is no confirmed active exploitation (CISA KEV does not list this CVE) and no public exploit code identified at time of analysis, and EPSS is low at 0.21% (11th percentile), so real-world urgency is modest even though the flaw sits in the kernel. Apple has shipped fixed builds across all affected platforms: iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.
RemediationAI
Vendor-released patches are the only complete fix: update to iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7 or macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 as applicable, using the per-platform advisories at support.apple.com/en-us/149034 through 149043 to confirm the correct build for each device. No documented workaround neutralizes the kernel bug, so until devices are upgraded the practical compensating controls target the prerequisite - locally installed malicious code - rather than the flaw itself: enforce managed/allow-listed application installation and block sideloading or unvetted enterprise apps on iPhone, iPad, Mac, Apple TV, Vision Pro and Apple Watch (trade-off: reduced user flexibility and potential friction for internal apps), and tighten Mobile Device Management restrictions and profile controls so that only notarized, signed apps from trusted developers can execute (trade-off: some line-of-business tooling may need re-signing or re-approval). Because exploitation yields kernel memory corruption, these controls should be paired with rapid patch deployment windows and monitoring for unexpected panics or reboots, which are the most visible symptom of a trigger; note that such telemetry is a detection aid, not a mitigation, and that jailbroken or sideload-enabled devices remain exposed regardless of configuration hardening.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is an out-of-bounds memory access in Apple's shared kernel (XNU), reached from an unprivileged app through a kernel-facing code path. The record is inconsistent about the exact primitive: the description states an out-of-bounds write that was addressed with improved bounds checking, while the assigned CWE is CWE-125 (Out-of-bounds Read); either way the root cause class is missing or insufficient length/bounds validation on a buffer before the kernel dereferences it. The relevant authorization boundary is the app-to-kernel interface, which is why the CVSS vector is local (AV:L) with low privileges (PR:L) and no user interaction (UI:N) - the attacker needs code executing on the device rather than a remote foothold. Because the target is shared kernel memory, a successful trigger can terminate the system unexpectedly or corrupt kernel state, which the independent assessment reflects by raising integrity and availability to High while confidentiality remains None (no information disclosure demonstrated). The CPE data confirms the flaw ships in the common kernel of the entire Apple platform family - cpe:2.3:a:apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos and apple:watchos - consistent with a single fix applied across parallel OS releases. The 'Information Disclosure' and 'Buffer Overflow' tags attached to this record should be treated cautiously given that only an availability/integrity impact is established and the CWE/description pair is contradictory.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local malicious app with low privileges and no user interaction; 'corrupt kernel memory' justifies I:H (not vendor's I:N) and 'system termination' gives A:H, no confidentiality impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB