EUVD-2026-49500
GHSA-w23g-g2m3-8h4f
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector set to Adjacent because attacker required on local network; all other metrics unchanged from NVD.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An attacker on the local network may be able to cause a denial-of-service.
AnalysisAI
Denial-of-service in multiple Apple operating systems allows a local network attacker to cause resource exhaustion and system unavailability. The vulnerability is addressed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No public exploit or active exploitation has been identified at this time, and the EPSS score is low (0.17%).
Technical ContextAI
The vulnerability is a CWE-400 Uncontrolled Resource Consumption, stemming from improper memory handling in Apple's operating system core components. Affected products include iOS & iPadOS, macOS (multiple versions), tvOS, visionOS, and watchOS, as identified by the CPE strings. The root cause involves a lack of bounds or resource limits when processing certain network input, leading to excessive memory consumption.
RemediationAI
Apply the vendor-released patches immediately. For iOS/iPadOS, upgrade to version 26.6; for macOS, upgrade to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6; for tvOS to 26.6; for visionOS to 26.6; for watchOS to 26.6. No workarounds are provided; however, restricting network access to trusted devices only may reduce exposure. Side effect: upgrading may require rebooting devices and could introduce compatibility issues with older applications.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today