EUVD-2026-49502
GHSA-pw2w-cc2c-542x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUser downloads malicious app
-
DeliveryUser runs the app
-
ExploitApp exploits out-of-bounds write
-
ExecutionKernel memory corruption
-
ImpactSystem terminates unexpectedly
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have the ability to run a crafted application on the target device (user interaction required). The vulnerability is triggered when the app processes data without proper bounds checking. No special configuration or elevated privileges are needed beyond running the app, but local access is mandatory. |
| Impact | CVSS 3.1 base score 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates a local attack with low complexity, requiring user interaction, and only impacting availability (no confidentiality or integrity loss). EPSS probability is low (0.16%, percentile 6%). CISA's SSVC framework reports no active exploitation, not automatable, and partial technical impact. These signals collectively suggest a limited real-world risk; the vulnerability is not currently targeted by attackers and the high CVSS is tempered by the local user interaction requirement and absence of data compromise. |
| Exploit ScenarioDerived | An attacker distributes a malicious app via the App Store or through side-loading. When a user runs the app, it triggers an out-of-bounds write by crafting input data, leading to a kernel panic and immediate system termination. As no public exploit code is identified, this scenario currently remains theoretical. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
An out-of-bounds write vulnerability in Apple iOS 26.6 and earlier allows a malicious app to cause unexpected system termination (kernel panic). No public exploit or active exploitation has been reported; patch available from Apple.
RemediationAI
Apple has released patched versions to fix this issue. Update to iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 via the vendor's software update mechanism. No workarounds are available; the only complete remediation is applying the patches from the advisory links provided.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an out-of-bounds write (CWE-787) occurring in the memory management of Apple's operating systems. This class of flaw typically arises when an application writes data beyond the allocated buffer boundary, potentially corrupting adjacent memory and leading to a crash. The CPE data confirms affectation across Apple's software ecosystem: iOS and iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS, all versions prior to 26.6.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local access, user interaction, only availability impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
3DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB