Skip to main content

Tvos CVE-2026-43780

| EUVDEUVD-2026-49479 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-07-27 apple GHSA-2qch-v8pw-3h94
7.8
CVSS 3.1 · Vendor: apple
Share

Severity by source

Vendor (apple) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (apple) · only source for this CVE.

CVSS VectorVendor: apple

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 28, 2026 - 16:57 vuln.today
Patch available
Jul 27, 2026 - 21:17 EUVD
CVE Published
Jul 27, 2026 - 20:12 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 27, 2026 - 20:12 cve.org
HIGH 7.8

DescriptionCVE.org

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted texture may lead to unexpected app termination.

AnalysisAI

We need to produce a JSON object with all the required fields. The input provides: CVE-2026-43780, description, CVSS vector and score, CWE, EPSS, patch info, CPEs, tags, SSVC, EUVD info, affected versions, references.

We must synthesize multi-source data. The CVE is about an integer overflow in iOS, iPadOS, macOS, tvOS, visionOS, watchOS when processing maliciously crafted texture. Fixed versions are given.

Key tasks: ensure every field is a plain text string, no arrays or objects. Follow all precision rules.

First, product_name: "iOS and iPadOS" (since that appears in the list, but it's a multi-product vulnerability. The instruction says "If multiple products, pick the primary one." The primary might be the overarching platform? The CPEs all start with apple. The product is a set of operating systems. Since the vulnerability is across many OS, maybe pick "Apple OS" or "Apple Operating Systems"? But the rule says 1-3 words, specific product. Could be "Apple iOS/iPadOS" but that's 2 words. I'll choose "Apple OS" as a collective term. However, the description mentions "iOS and iPadOS" first, then macos, etc. The most specific product name might be "iOS" as the representative. The rule says "NOT the vendor alone", so "Apple" isn't enough. "iOS" is a product. But vulnerability affects multiple products, but we need to pick the primary one. Since the title often says "iOS and iPadOS", it's a combo. I could say "iOS and iPadOS". That's 3 words. That's acceptable. I'll go with "iOS and iPadOS".

Summary: Must not copy description. Must be original synthesis using all data. Start with impact verb and product. E.g., "Processing a maliciously crafted texture on Apple devices running iOS, iPadOS, macOS, tvOS, visionOS, or watchOS may cause an integer overflow leading to unexpected app termination." But need to mention CVSS, EPSS, POC status, KEV. No KEV here, no POC mentioned. So "no public exploit identified at time of analysis". EPSS score low (0.17%, percentile 6%). So s

More in Tvos

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit

CVE-2017-13861 HIGH POC
7.8 Dec 25

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati

CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici

CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar

CVE-2016-4669 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp

CVE-2017-2370 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati

CVE-2017-11120 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo

CVE-2017-2446 HIGH POC
8.8 Apr 02

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi

CVE-2017-2524 CRITICAL POC
9.8 May 22

An issue was discovered in certain Apple products. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex

CVE-2017-7047 HIGH POC
8.8 Jul 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi

CVE-2015-7112 CRITICAL POC
9.3 Dec 11

The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attacke

Share

CVE-2026-43780 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy