EUVD-2026-77990
GHSA-hmx3-x542-g37c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted video to victim
-
ExploitVictim opens/processes file in app
-
ExecutionTrigger memory corruption in video parser
-
ImpactApp termination or memory corruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to process a maliciously crafted video file (UI:R) within a vulnerable Apple OS media component on iOS/iPadOS before 26.6/26.7, macOS Sequoia before 15.8 or Tahoe before 26.6/26.7, tvOS/watchOS before 26.6. The vector is local (AV:L): the attacker cannot trigger it purely remotely without delivering the file and inducing the user to open or preview it. No authentication is required (PR:N), but the dependency on user-initiated file processing and the absence of any confirmed code-execution or data-disclosure primitive limit realistic impact to app crashes and in-process memory corruption. |
| Impact | The vendor CVSS of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reads as a local file-parsing memory-corruption flaw, but the description only substantiates 'unexpected app termination or corrupt process memory' - a crash and in-process memory corruption, with no stated confidentiality disclosure or confirmed code execution. The full C:H/I:H/A:H triad is therefore generous Apple boilerplate; the concrete, evidenced impact is availability (crash) plus limited integrity of process memory, so my independent assessment is closer to ~5.5. Real-world urgency signals are all low: EPSS is 0.18% (7th percentile), the CVE is NOT in CISA KEV, and no public exploit is identified. This is a routine media-parser hardening fix rather than an actively-exploited priority: no public exploit identified at time of analysis. The AV:L/UI:R combination means an attacker must get a victim to open or process a crafted video in a vulnerable app, which materially constrains scalability. Note the metric-vs-description gap: vendor claims high confidentiality/integrity impact that the terse 'app termination or corrupt process memory' text does not support - verify actual exploitability with Apple's advisory before treating as RCE. |
| Exploit ScenarioDerived | An attacker crafts a malicious video file and delivers it via message, email, web page, or a shared file, relying on the victim to open or preview it in a vulnerable Apple app. Processing the malformed video triggers a memory-safety violation (CWE-119) that crashes the app or corrupts process memory. No public proof-of-concept is available, and local access with user interaction (UI:R) is required, limiting mass exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
On unpatched Apple platforms, opening a maliciously crafted video file can cause the affected app to terminate unexpectedly or leave process memory corrupted, because the underlying media parsing code fails to handle memory correctly. Affected are iOS/iPadOS before 26.6 or 26.7, macOS Sequoia before 15.8, macOS Tahoe before 26.6 or 26.7, tvOS before 26.6, and watchOS before 26.6; the vector is local (AV:L) with user interaction required (UI:R) and no authentication (PR:N), meaning an attacker must deliver the file and convince the user to open or preview it. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile), but the flaw is serious: the description substantiates only app crashes and in-process memory corruption, with no confirmed confidentiality disclosure or code-execution primitive, which is narrower than the vendor's 7.8 high-severity rating implies. Vendor patches are available.
RemediationAI
Apply the vendor updates: iOS 26.6 and iPadOS 26.6 (or 26.7), macOS Sequoia 15.8, macOS Tahoe 26.6 (or 26.7), tvOS 26.6, and watchOS 26.6 - the exact fixed versions named by Apple - following the guidance at support.apple.com/en-us/128066, 128067, 128068, 128069, 149041, 149042, and 149043. The vendor-released patch addresses the memory-handling defect directly, so it is the only complete fix and should be prioritized on devices that regularly process media from untrusted sources (messaging, mail, shared cloud folders, and browser download directories). Until devices can be updated, compensating controls are limited and have real trade-offs: train users not to open or preview video attachments from unknown senders (best-effort, depends on user compliance and does not stop drive-by thumbnail or preview generation in some clients); disable or restrict automatic media previews and thumbnail generation in mail and messaging clients (effective but degrades usability and may not cover every code path that decodes video); route inbound media through an isolated viewer or sandboxed device (strong containment of any corruption but requires parallel infrastructure and workflow changes); and restrict which applications can open untrusted media types (reduces the attack surface for decode paths but can break legitimate workflows). Because the vector is local (AV:L) and requires user interaction (UI:R), hardening the delivery path - blocking executable media containers, filtering attachments at the gateway, and isolating high-risk users - measurably reduces exposure but does not substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a memory-handling defect classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic out-of-bounds read/write class that arises when parsing structured data - here media/video containers and codec payloads - and the parser's bounds checks on buffers, lengths, or indices are insufficient. Apple's note states the issue was addressed with improved memory handling, indicating the fix hardens allocation and bounds logic in the media framework rather than adding a policy-level mitigation. The CPE data confirms the affected components ship as part of the Apple operating system families (ios_and_ipados, macos, tvos, watchos), so the vulnerable code lives in a shared system media stack reachable from any application that decodes or previews video (Messenger, Mail, Photos, browser rendering, thumbnail generation). The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes a local attack that is trivially reproducible once the file is opened, requiring no privileges but dependent on the victim interacting with attacker-supplied content; our independent assessment narrows the realistic outcome to availability impact and limited integrity loss (C:N/I:L/A:H), since neither the vendor description nor available intelligence demonstrates information disclosure or reliable code execution. EPSS of 0.18% (percentile 7%) is consistent with a locally triggered file-parsing bug that is not being mass-exploited.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local crafted-file parsing needs user interaction (AV:L/UI:R); description supports process crash (A:H) and memory corruption (I:L) but no confidentiality disclosure (C:N).
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.6, macOS Tahoe 26.7, tvOS 26.6, watchOS 26.6. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.
Executive ViewAI
A memory-handling flaw in Apple's media parsing components affects iPhones, iPads, Macs, Apple TVs, and Apple Watches running unpatched software, allowing a maliciously crafted video file to crash the viewing application or corrupt its in-process memory. Exploitation requires an attacker to deliver a crafted file and persuade a user to open or preview it; no public exploit code or confirmed active exploitation has been identified, so near-term risk is limited to targeted, user-assisted attempts against our Apple device fleet. Because these devices carry email, messaging, and executive communications, leadership should treat fleet-wide update deployment as the primary risk-reduction action.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB