EUVD-2026-77861
GHSA-vmpg-5m9v-32v3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Remote malicious WebDAV server needs no credentials but requires victim-initiated connection (UI:R); vendor reports termination only, so C/I are None.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
An out-of-bounds write issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious WebDAV server may lead to unexpected app termination.
AnalysisAI
An out-of-bounds write in Apple macOS is triggered when a user connects to a malicious WebDAV server, resulting in unexpected application termination. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27, and is reachable over the network with no privileges required but with user interaction (the victim must initiate the WebDAV connection). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to connect to an attacker-controlled WebDAV server - the exact condition stated in the description ('Connecting to a malicious WebDAV server'). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) produces a 6.5 - network-reachable, low complexity, unauthenticated on the attacker's side, but gated by required user interaction and capped at a high availability impact only. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patches: update macOS Sequoia to 15.8, macOS Tahoe to 26.7, or macOS Golden Gate to 27 via Software Update, per Apple advisories https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149042, and https://support.apple.com/en-us/149043. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today