EUVD-2026-77917
GHSA-8624-hc38-mw7x
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Local malicious-file processing needs victim interaction (AV:L/UI:R) but no attacker privileges (PR:N); confirmed impact is DoS (A:H) with only potential partial memory leak (C:L), no integrity.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.
AnalysisAI
Processing a maliciously crafted file on Apple macOS versions below Golden Gate 27 can crash the affected component, causing a denial-of-service, and may potentially leak partial memory contents. The bug is an integer overflow (CWE-190) corrected through improved input validation, and exploitation requires a local victim to actually open or handle the attacker-supplied file, so both a local attack vector and user interaction are prerequisites. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local victim on an affected macOS version (any build below macOS Golden Gate 27) to open or process an attacker-supplied, maliciously crafted file - the mandatory user interaction (UI:R) and local attack vector (AV:L) are the primary limiting factors. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity local issue, not a high-priority emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: macOS Golden Gate 27 - upgrading to this version (or any later release) resolves the integer overflow through Apple's improved input validation, and the change is documented at https://support.apple.com/en-us/149035. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today