EUVD-2026-49517
GHSA-cx4g-f25m-gh9h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description limits this to a locally installed app causing system termination, so AV:L and PR:L with availability-only impact (A:H); no confidentiality or integrity loss is indicated.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
AnalysisAI
Denial of service in Apple operating systems (iOS/iPadOS 26.6, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS/visionOS/watchOS 26.6) allows a locally installed app to trigger an integer overflow that causes unexpected system termination. The flaw was reported and patched by Apple, and CISA's SSVC framework rates exploitation as 'none' with EPSS at just 0.17% (6th percentile), indicating no public exploit identified at time of analysis. Note a significant signal conflict: the NVD CVSS vector of 9.8 (AV:N, full C/I/A impact) is inconsistent with the description, which describes only an app-triggered crash.
Technical ContextAI
The root cause is CWE-190 (Integer Overflow or Wraparound), which Apple states was 'addressed with improved input validation.' An integer overflow occurs when an arithmetic operation produces a value exceeding the storage width of its integer type, wrapping around to an unexpected (often small or negative) value; when that value is subsequently used for memory allocation, bounds checking, or indexing, it can lead to undersized buffers and out-of-bounds access - consistent with the associated 'Buffer Overflow' tag. The CPE data confirms the defect spans Apple's shared OS foundation across ios_and_ipados, macos, tvos, visionos, and watchos, strongly implying a common framework/kernel component rather than a per-platform bug. The observed impact ('unexpected system termination') indicates the overflow reaches a critical code path whose corruption results in a kernel or system-level panic rather than a contained application crash.
RemediationAI
Apply the vendor-released patches (Patch available per vendor advisory): upgrade to iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, or watchOS 26.6 as appropriate for each device, following the platform-specific advisories at support.apple.com/en-us/128066 through 128072. Because exploitation requires a locally installed app, the most effective compensating control until patching is to restrict app installation to trusted sources - enforce MDM app allowlisting and disable sideloading/enterprise-cert app installs on managed fleets; the trade-off is reduced flexibility for users who install third-party or internal apps. There are no vendor-published configuration workarounds, so timely OS updating is the definitive fix.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today