EUVD-2026-49517
GHSA-cx4g-f25m-gh9h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious app to device
-
DeliveryApp submits crafted oversized input
-
ExploitInteger overflow wraps allocation size
-
ExecutionOut-of-bounds memory corruption
-
ImpactUnexpected system termination (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to get a malicious app running on the target device - the description states 'An app may be able to cause unexpected system termination,' so local app execution is the concrete prerequisite, not remote network access. Limiting factors: the attacker must first achieve app installation/execution (via App Store abuse, sideloading, enterprise provisioning, or an already-compromised app), and the confirmed impact is availability loss (system termination), not code execution or data disclosure. This contradicts the NVD AV:N/PR:N rating; defenders should treat the realistic vector as local, app-delivered, and low-to-no-privilege within the app sandbox. |
| Impact | The signals conflict and must be reconciled. The NVD CVSS 3.1 vector (9.8, AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) implies remote, unauthenticated, full-impact compromise - but the Apple description explicitly states 'An app may be able to cause unexpected system termination,' which is a LOCAL, app-delivered denial of service with availability-only impact and no stated confidentiality or integrity loss. This is a clear discrepancy: the CVSS network vector and high C/I ratings are not supported by the description - verify with the vendor before treating this as remotely exploitable. Corroborating the lower real-world risk: EPSS is only 0.17% (6th percentile), there is no KEV listing, and SSVC rates Exploitation as 'none.' SSVC does flag Automatable:yes and Technical Impact:total, but 'total' technical impact in an app-sandbox-escape/crash context still requires local code execution via a malicious app. Overall this is a genuine bug worth patching in normal cadence, but the headline 9.8 substantially overstates practical risk given local delivery, availability-only observed impact, and negligible exploitation probability. |
| Exploit ScenarioDerived | An attacker publishes or sideloads a malicious app onto a target Apple device; when run, the app passes crafted input that triggers the integer overflow in a shared system component, causing the device to unexpectedly terminate or panic and repeatedly crash. No public exploit code has been identified, and the impact observed is denial of service rather than data theft. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Denial of service in Apple operating systems (iOS/iPadOS 26.6, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS/visionOS/watchOS 26.6) allows a locally installed app to trigger an integer overflow that causes unexpected system termination. The flaw was reported and patched by Apple, and CISA's SSVC framework rates exploitation as 'none' with EPSS at just 0.17% (6th percentile), indicating no public exploit identified at time of analysis. Note a significant signal conflict: the NVD CVSS vector of 9.8 (AV:N, full C/I/A impact) is inconsistent with the description, which describes only an app-triggered crash.
RemediationAI
Apply the vendor-released patches (Patch available per vendor advisory): upgrade to iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, or watchOS 26.6 as appropriate for each device, following the platform-specific advisories at support.apple.com/en-us/128066 through 128072. Because exploitation requires a locally installed app, the most effective compensating control until patching is to restrict app installation to trusted sources - enforce MDM app allowlisting and disable sideloading/enterprise-cert app installs on managed fleets; the trade-off is reduced flexibility for users who install third-party or internal apps. There are no vendor-published configuration workarounds, so timely OS updating is the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-190 (Integer Overflow or Wraparound), which Apple states was 'addressed with improved input validation.' An integer overflow occurs when an arithmetic operation produces a value exceeding the storage width of its integer type, wrapping around to an unexpected (often small or negative) value; when that value is subsequently used for memory allocation, bounds checking, or indexing, it can lead to undersized buffers and out-of-bounds access - consistent with the associated 'Buffer Overflow' tag. The CPE data confirms the defect spans Apple's shared OS foundation across ios_and_ipados, macos, tvos, visionos, and watchos, strongly implying a common framework/kernel component rather than a per-platform bug. The observed impact ('unexpected system termination') indicates the overflow reaches a critical code path whose corruption results in a kernel or system-level panic rather than a contained application crash.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description limits this to a locally installed app causing system termination, so AV:L and PR:L with availability-only impact (A:H); no confidentiality or integrity loss is indicated.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
Executive ViewAI
CVE-2026-43769 is a CRITICAL Denial of Service flaw in Apple's operating systems (iOS, macOS, tvOS, watchOS, visionOS) triggered by locally installed applications, with potential to cause unexpected system crashes. Apple has released patches for all affected platforms, and the actual exploitation risk remains very low-this represents a prioritized patch-and-verify matter rather than an immediate operational threat to data security or system compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB