EUVD-2026-77969
GHSA-8wrm-5h46-7w5h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious image file
-
DeliveryDeliver to victim (message/web/file)
-
ExploitVictim's device processes image
-
ExecutionTrigger memory corruption in parser
-
ImpactApplication crashes (denial-of-service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to process a maliciously crafted image on an affected device (iOS/iPadOS <18.7.10, macOS <14.8.8 Sonoma / <15.7.8 Sequoia / <27 Golden Gate). This is a local, user-interaction-dependent vector (AV:L/UI:R): the attacker cannot trigger it remotely without the target opening or automatically rendering the malicious image. The maximum realistic outcome per the advisory is a denial-of-service (application/process crash) - no confidentiality or integrity impact is claimed. Limiting factors: patched OS versions are immune, and the attacker must first get the crafted image parsed by the victim's device. |
| Impact | All signals point to a low-priority, low-severity issue despite the memory-corruption root cause. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H = 5.5 Medium) is internally consistent with the description: the only stated impact is denial-of-service, so C:N/I:N/A:H is correctly scored - unusually disciplined for Apple, which frequently inflates crash-only image/media bugs to C:H/I:H (contrast siblings CVE-2026-65344 and CVE-2026-84511). Attack vector is local (AV:L) requiring the victim to process a maliciously crafted image (UI:R), meaning there is no remote unauthenticated path. EPSS is 0.20% (10th percentile) - very low probability of exploitation. There is no CISA KEV listing and no public POC identified, so exploitation status is theoretical. No SSVC decision data was provided. The one point worth verifying: CWE-119 (memory corruption / bounds) plus 'improved bounds checking' hints at latent code-execution potential that Apple down-scoped to DoS; treat the A:H/DoS-only characterization as vendor-stated, not independently confirmed. Net: patch on normal cadence, not an emergency. |
| Exploit ScenarioDerived | An attacker crafts a malformed image file and delivers it to a victim via email, message, website, or shared file; when the victim's iOS/iPadOS/macOS device parses the image, the bounds-checking flaw corrupts memory and terminates the processing application (denial-of-service). No public exploit code or active exploitation has been identified, and the local attack vector plus required user interaction significantly limit real-world impact. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Processing a maliciously crafted image on unpatched Apple devices can trigger a memory-corruption fault that crashes the affected process, producing a local denial-of-service (CVSS 3.1 base 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Affected platforms are iOS and iPadOS before 18.7.10 and macOS before Sonoma 14.8.8, Sequoia 15.7.8, and Golden Gate 27; the attacker cannot trigger the flaw remotely and must get the victim to open or auto-render the crafted image. All signals point to a low-priority issue: EPSS is 0.20% (10th percentile), no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are already available.
RemediationAI
Vendor-released patch: upgrade to iOS 18.7.10 / iPadOS 18.7.10, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, or macOS Golden Gate 27 as applicable - installing the corresponding Apple update fully removes this attack surface (see https://support.apple.com/en-us/128071, https://support.apple.com/en-us/128072, https://support.apple.com/en-us/148287, https://support.apple.com/en-us/149035). Because exploitation only occurs when a crafted image is parsed locally, interim mitigations for devices that cannot be updated immediately are to instruct users not to open images from untrusted sources and to disable features that auto-render or auto-preview attachments/images (for example, automatic image loading in messaging and mail clients, or automatic thumbnail/preview generation for untrusted shares); the trade-off is degraded media functionality and added user friction, and these controls reduce but do not eliminate the risk since any image-rendering path remains reachable. The impact is availability-only (process crash), so the practical exposure of delaying the update is limited, and no public exploit code has been identified at time of analysis; nevertheless, patch priority should follow normal Apple security-update cadence rather than emergency response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is classified as CWE-119, improper restriction of operations within the bounds of a memory buffer, and Apple describes the root cause as a memory-corruption issue addressed through improved bounds checking in the image-handling code path. Because the flaw sits in image decoding/parsing, the attack surface is any application or system service that renders untrusted image data (photo viewers, messaging previews, browser rendering, thumbnail generation), but exploitation requires that data to be parsed locally after user interaction, hence the AV:L/UI:R vector with PR:N (no privileges required to trigger the crash). The CPE strings (cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos with wildcard versions) confirm this is a shared component fix rolled into multiple OS release trains - iOS/iPadOS 18.7.10, macOS Golden Gate 27, macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8 - consistent with EUVD's affected ranges. Scope is unchanged (S:U), impact is availability-only (C:N/I:N/A:H): a crash or process termination rather than code execution, data theft, or persistence, and patched systems are not vulnerable.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local image-parsing bug needing victim interaction (AV:L/UI:R); vendor description supports crash-only impact, so C:N/I:N and A:H, no privileges required.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. Processing a maliciously crafted image may lead to a denial-of-service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB