Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (apple) · only source for this CVE.
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted texture may lead to unexpected app termination.
AnalysisAI
We need to produce a JSON object with all the required fields. The input provides: CVE-2026-43780, description, CVSS vector and score, CWE, EPSS, patch info, CPEs, tags, SSVC, EUVD info, affected versions, references.
We must synthesize multi-source data. The CVE is about an integer overflow in iOS, iPadOS, macOS, tvOS, visionOS, watchOS when processing maliciously crafted texture. Fixed versions are given.
Key tasks: ensure every field is a plain text string, no arrays or objects. Follow all precision rules.
First, product_name: "iOS and iPadOS" (since that appears in the list, but it's a multi-product vulnerability. The instruction says "If multiple products, pick the primary one." The primary might be the overarching platform? The CPEs all start with apple. The product is a set of operating systems. Since the vulnerability is across many OS, maybe pick "Apple OS" or "Apple Operating Systems"? But the rule says 1-3 words, specific product. Could be "Apple iOS/iPadOS" but that's 2 words. I'll choose "Apple OS" as a collective term. However, the description mentions "iOS and iPadOS" first, then macos, etc. The most specific product name might be "iOS" as the representative. The rule says "NOT the vendor alone", so "Apple" isn't enough. "iOS" is a product. But vulnerability affects multiple products, but we need to pick the primary one. Since the title often says "iOS and iPadOS", it's a combo. I could say "iOS and iPadOS". That's 3 words. That's acceptable. I'll go with "iOS and iPadOS".
Summary: Must not copy description. Must be original synthesis using all data. Start with impact verb and product. E.g., "Processing a maliciously crafted texture on Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, or watchOS may cause an integer overflow leading to unexpected app termination." But need to mention CVSS, EPSS, POC status, KEV. No KEV here, no POC mentioned. So "no public exploit identified at time of analysis". EPSS score low (0.17%, percentile 6%). So s
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
An issue was discovered in certain Apple products. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attacke
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-49479
GHSA-2qch-v8pw-3h94