EUVD-2026-49511
GHSA-q9xv-pwq9-9x39
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUser installs malicious app
-
DeliveryLaunch app in sandbox
-
ExploitTrigger integer overflow (CWE-190)
-
ExecutionCorrupt memory via OOB access
-
PersistEscape app sandbox
-
ImpactAccess data beyond sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to install and run a malicious application locally on the affected Apple device (AV:L, UI:R, PR:N) - the app itself is the attacker's vehicle, and no separate authentication is needed once it runs. Limiting factors: the attacker must first get the malicious app onto the device and have the user launch it, and the target must be running an unpatched OS version (below iOS/iPadOS 26.6, macOS 14.8.8/15.7.8/26.6, or watchOS 26.6); there is no remote or network-triggered path. |
| Impact | The CVSS 3.1 base score is 8.6 (High), driven by scope change (S:C) and total impact (C:H/I:H/A:H), but the vector is local (AV:L) and requires user interaction (UI:R) - the user must run the malicious app - so it is not remotely reachable. CISA SSVC aligns partially: technical impact is 'total' while exploitation is 'none' and automatable is 'no', indicating no evidence of active exploitation and no scalable attack. EPSS is very low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis, so real-world urgency is moderate rather than emergency. The signals are consistent: high potential impact if exploited, but exploitation requires local app execution and none is currently observed - patch promptly, but this is not an actively-exploited zero-day. |
| Exploit ScenarioDerived | An attacker publishes or sideloads a malicious application that a victim installs and launches; on execution the app triggers the integer overflow to corrupt memory and escape the app sandbox, gaining access beyond its permitted boundaries. No public proof-of-concept is identified at time of analysis, and the local vector with required user interaction means the victim must actually run the attacker's app. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Apple iOS/iPadOS, macOS, and watchOS lets a malicious application break out of its sandbox by triggering an integer overflow (CWE-190) in shared OS code, potentially gaining access beyond its permitted boundaries. Apple discovered and reported the issue and shipped fixes across its platform lineup; there is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none, though the total technical impact and scope change make it a meaningful local sandbox-escape risk. EPSS is low (0.16%, 6th percentile), consistent with no observed exploitation.
RemediationAI
Vendor-released patch: update to iOS 26.6, iPadOS 26.6, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, or watchOS 26.6 as applicable to each device, via Software Update or MDM; the corresponding advisories are at support.apple.com/en-us/128066, 128067, 128068, 128071, and 128072. Because exploitation requires running a malicious app, an interim compensating control is to restrict installation to the App Store and vetted MDM-managed apps, disable sideloading and enterprise-signed app trust, and avoid installing untrusted applications until patched - the trade-off is reduced flexibility for internally distributed enterprise apps.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an integer overflow (CWE-190) - an arithmetic operation producing a value outside the representable range - which Apple states was addressed with improved input validation. Such overflows typically cause undersized allocations or out-of-bounds memory access (the tags also cite Buffer Overflow), which in a sandboxed-app context can be leveraged to escape the app sandbox that normally confines third-party applications on Apple platforms. The CPE data confirms the affected code spans Apple's shared OS foundations across ios_and_ipados, macos, and watchos, indicating the vulnerable component is common cross-platform Apple OS code rather than a single app.
Know when Watchos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
A local malicious app (AV:L) run by the user (UI:R, PR:N) triggers a sandbox escape crossing a trust boundary (S:C) with full C/I/A impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, watchOS 26.6. A malicious app may be able to break out of its sandbox.
Executive ViewAI
A high-severity local vulnerability in Apple iOS, iPadOS, macOS, and watchOS (CVE-2026-28973) allows malicious applications to bypass security boundaries and gain unauthorized system access. Vendor patches are available and no active exploitation is currently observed, making this a manageable risk with prompt mitigation. Your organization should prioritize patch deployment across all Apple devices to prevent compromised applications from becoming escalation vectors for data theft or system compromise.
Apply vendor patch. Until patches are deployed, restrict application installation to pre-approved sources and monitor for suspicious system-level privilege escalation attempts on unpatched devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in I
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
Exploit-DB