EUVD-2026-49551
GHSA-84qx-fjmg-vr64
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description supports remote unauthenticated trigger (AV:N/PR:N) with confirmed kernel crash (A:H); memory corruption implies at most I:L and no confidentiality loss (C:N), so 9.8 is overstated.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.
AnalysisAI
Kernel memory corruption in Apple macOS allows a remote, unauthenticated attacker to crash the system or corrupt kernel memory on hosts running versions prior to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6. Apple's advisory attributes the flaw to insufficient bounds checking (CWE-120), and although the vendor rates it 9.8 with full confidentiality, integrity, and availability impact, our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - the demonstrated outcome is denial of service through kernel termination or memory corruption, with code execution not proven and the triggering service, protocol, or listener undisclosed. No public exploit has been identified at time of analysis, EPSS is low (0.26%, 18th percentile), and CISA's SSVC records exploitation as 'none'; vendor-released patches are available, so remediation should be prioritized on network-exposed macOS hosts rather than treated as an emergency active-exploitation event.
Technical ContextAI
The root cause is a classic buffer overflow (CWE-120, buffer copy without checking size of input) in macOS kernel code, where remotely supplied data is processed without adequate size validation, allowing memory past the intended buffer boundary to be overwritten. Apple describes only that the issue 'was addressed with improved bounds checking', which places the fix in the XNU kernel's input-handling path and means the vulnerable code is reachable by kernel-level parsing of attacker-influenced data rather than by a user-space application. The affected CPE, cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, covers the entire macOS line, and EUVD enumerates version ranges macOS 0 <15.7.8, macOS 0 <26.6, and macOS 0 <14.8.8, spanning Sonoma, Sequoia, and Tahoe branches. Notably, Apple does not name the specific service, protocol, or network listener involved, so the precise attack surface - and whether exploitation requires any particular service to be enabled or reachable - cannot be confirmed from available data. Because the defect sits in the kernel, a successful overflow yields at minimum a kernel panic or memory corruption; whether the corrupted kernel memory can be shaped into controlled code execution was not established by the vendor's description or by the independent assessment.
RemediationAI
Vendor-released patch: apply macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6 (or later) per Apple advisories https://support.apple.com/en-us/128067, https://support.apple.com/en-us/128071, and https://support.apple.com/en-us/128072; upgrading the macOS build is the only complete fix because the defect is in the kernel itself. Where immediate upgrade is not possible, compensating controls should target the network reachability the attack requires: enable the macOS application firewall and block unsolicited inbound connections to the host, and disable or unbind any network services, sharing daemons, or listeners that are not strictly required - the trade-off is loss of remote management, file sharing, and similar functionality, and because Apple has not disclosed the specific affected service, this is a broadly applied reduction of attack surface rather than a precisely targeted workaround. Restrict vulnerable hosts to trusted network segments or require them to sit behind a filtering gateway, accepting the operational cost of constrained connectivity and the residual risk that a local or same-segment vector could still reach the kernel flaw. Monitoring for repeated kernel panics or unexpected reboots on unpatched hosts can serve as a coarse detection signal for exploitation attempts. Priority should be highest for internet-facing or remotely administered Macs; given no public exploit and an EPSS of 0.26% (18th percentile), patching can follow normal change-management timelines for isolated endpoints.
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today