EUVD-2026-49612
GHSA-vp5c-8x5g-v7j9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUser downloads malicious app
-
ExploitApp runs on device
-
ExecutionOut-of-bounds write triggers kernel memory corruption
-
ImpactSystem terminates unexpectedly
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | User interaction is required (UI:R)-the victim must run the crafted app on a vulnerable device. The attacker needs local access (AV:L) to run code; this can be achieved by distributing the app through normal app installation channels. No special configuration is needed; default OS settings suffice for exploitation. The limiting factor is the need for social engineering or app store approval to get the malicious app onto the device. |
| Impact | The CVSS v3.1 base score is 5.5 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating local access, low complexity, no privileges, but user interaction required, and only availability impact. EPSS probability is 0.16% (low). CISA KEV does not list this CVE, and SSVC assessment reports no exploitation, not automatable, and partial technical impact. Comparing these signals, the vulnerability presents low real-world risk: it is not actively exploited, requires user interaction to run a malicious app, and results only in a denial of service rather than data compromise. The high CVSS availability impact is mitigated by the local and interactive prerequisites. |
| Exploit ScenarioDerived | An attacker convinces a user to install a crafted malicious app on an unpatched Apple device. The app triggers an out-of-bounds write in a system memory buffer, causing a kernel panic or watchdog timeout that results in unexpected system termination (denial of service). No public exploit code is known, but the technical nature of the bug is straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Denial of service in Apple operating systems via out-of-bounds write allows a local app to cause unexpected system termination. Affected versions include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS prior to 26.6. No active exploitation has been reported, EPSS risk is low at 0.16%, and no public exploit code identified at time of analysis.
RemediationAI
Apply the vendor-released patches: update to iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Patches are available from Apple via the respective advisory links. No workarounds are documented; the only effective mitigation is updating affected devices. For devices that cannot receive the update, restrict app installation to trusted sources to reduce the chance of malicious app execution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an out-of-bounds write (CWE-787) in memory handling routines within Apple's operating system kernels or system frameworks. CPE data confirms all Apple OS families (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) are affected. The root cause is insufficient bounds checking on a buffer, allowing an app to write beyond allocated memory. This corruption can lead to a system panic or termination, representing a denial-of-service condition.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local access, user interaction, only availability impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB