EUVD-2026-29307
GHSA-cm8r-x63q-3wvp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker joins local network
-
DeliveryCraft out-of-bounds write packet
-
ExploitSend to target device
-
InstallTrigger buffer overflow in OS network handler
-
C2Corrupt adjacent memory
-
ExecuteCrash service or OS
-
ImpactTarget device denial-of-service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must be present on the same local network segment (Wi-Fi, Ethernet) as the target device; remote exploitation across the internet is not possible. No authentication, user interaction, or special configuration is required from the target device - vulnerability affects standard default configurations. The out-of-bounds write is triggered by normal local network communication patterns, suggesting the flaw exists in low-level network protocol handling or shared OS library code. Specific trigger conditions (exact packet format, protocol, service) are not disclosed by Apple. |
| Impact | CVSS 6.2 (AV:L/AC:L/PR:N/UI:N) indicates medium severity with local attack vector and no privilege or user interaction requirements. However, EPSS 0.02% (7th percentile) signals extremely low exploitation probability in real deployments - a striking disconnect. No CISA KEV status or public proof-of-concept identified. The denial-of-service impact alone (no confidentiality or integrity breach per CVSS vector) limits real-world harm compared to RCE vulnerabilities. The local network constraint is critical: attackers must be on the same LAN segment or connected to the same Wi-Fi/Ethernet network, reducing threat scope versus remote exploits. SSVC framework assessment: Exploitation status is UNPROVEN (not yet in KEV, no POC public), technical impact is SEVERE (DoS), but automatable exploitation is doubtful given local network prerequisite. Real risk is conditional and geographically/logically bounded. Organizations should prioritize patching high-risk systems on hostile networks; typical enterprise or home users are low-priority targets. |
| Exploit ScenarioDerived | An attacker connected to the same Wi-Fi network as a target device sends specially crafted local network packets that trigger the out-of-bounds write condition in a vulnerable network service or process. The write corrupts adjacent memory, causing the service to crash and rendering the device unresponsive (DoS). Restart of the affected service or device restores function, but repeated exploitation causes repeated denial-of-service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 12, 2026
Out-of-bounds write in Apple operating systems allows local network attackers to cause denial-of-service via improved bounds checking bypass. Affects iOS/iPadOS (18.7.9+, 26.5+), macOS Sequoia (15.7.7+), Sonoma (14.8.7+), Tahoe (26.5+), tvOS (26.5+), visionOS (26.5+), and watchOS (26.5+). EPSS score of 0.02% indicates very low real-world exploitation probability despite local attack vector.
RemediationAI
Vendor-released patches available: upgrade iOS/iPadOS to 18.7.9 or 26.5 or later, macOS Sequoia to 15.7.7 or later, macOS Sonoma to 14.8.7 or later, macOS Tahoe to 26.5 or later, tvOS to 26.5 or later, visionOS to 26.5 or later, and watchOS to 26.5 or later. Patches are delivered via Apple Software Update on each platform. For systems that cannot be patched immediately, restrict network access from untrusted local networks by disabling Wi-Fi connectivity in hostile environments or using network segmentation (VLANs, firewalls) to isolate vulnerable devices from untrusted subnets. This mitigation does not eliminate risk on shared networks (offices, public Wi-Fi) where attackers may be present. Prioritize patching for devices frequently exposed to untrusted local networks (tablets, watches, Macs in offices). Refer to Apple support articles 127110-127120 for detailed patching instructions per device type.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is a classic out-of-bounds write flaw (CWE-787) - a memory corruption issue where code writes data beyond the allocated bounds of a buffer. The improved bounds checking fix suggests the underlying code was not properly validating buffer sizes or array indices before write operations. Across the affected CPE products (Apple iOS/iPadOS, macOS variants, tvOS, visionOS, watchOS), the specific component performing the vulnerable write operation is not named in the public description, indicating Apple may be withholding technical details to avoid aiding exploitation. The local network requirement constrains attack surface to devices sharing network segments, unlike remotely exploitable buffer overflows.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (apple) · only source for this CVE.
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An attacker on the local network may be able to cause a denial-of-service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB