What is the CVSS score of CVE-2026-39870?

CVE-2026-39870 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apple are affected by CVE-2026-39870?

Apple macOS contains a high-severity remote memory corruption flaw (CVE-2026-39870) that could lead to unauthorized access to sensitive corporate data through malicious image files.. A patch is available.

How to fix or mitigate CVE-2026-39870?

Within 24 hours, inventory all macOS Sequoia, Sonoma, and Tahoe deployments and assess patch deployment readiness. Within 7 days, deploy patches (Sequoia 15.7.7, Sonoma 14.8.7, Tahoe 26.5) to development and test systems to validate compatibility, then begin staged rollout to production. Complete full deployment across all affected systems within 30 days, prioritizing user-facing and sensitive-data workstations.

Apple CVE-2026-39870

EUVD-2026-29293 HIGH

Buffer Overflow (CWE-119)

2026-05-11 apple

GHSA-r2mj-8p47-g2fc

Buffer Overflow Apple

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:43 vuln.today

CVSS changed

May 12, 2026 - 19:22 NVD

7.5 (HIGH)

Patch available

May 11, 2026 - 22:18 EUVD

CVE Published

May 11, 2026 - 20:07 nvd

UNKNOWN (no severity yet)

CVE Published

May 11, 2026 - 20:07 nvd

HIGH 7.5

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Processing a maliciously crafted image may corrupt process memory.

AnalysisAI

Memory corruption in Apple macOS image processing allows a remote attacker to corrupt process memory by delivering a maliciously crafted image to an affected system, potentially leading to sensitive information disclosure. The flaw affects macOS Sequoia before 15.7.7, macOS Sonoma before 14.8.7, and macOS Tahoe before 26.5, and was fixed by Apple with improved memory handling. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.02%, 4th percentile), and it is not listed in CISA KEV.