EUVD-2026-49554
GHSA-fpvq-93x4-j4x7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated buffer overflow likely yields arbitrary code execution; Apple's CVSS assigns full impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption.
AnalysisAI
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause application termination or arbitrary code execution. Affected products include iOS and iPadOS prior to version 26.6, macOS before Sequoia 15.7.8 and Tahoe 26.6, tvOS before 26.6, and visionOS before 26.6; no active exploitation or public proof-of-concept has been reported.
Technical ContextAI
The vulnerability stems from a buffer overflow (CWE-119) in an unspecified Apple operating system component where improper bounds checking allows unauthenticated remote attackers to overwrite heap memory. The vulnerability is present in all supported Apple platforms, as indicated by CPE records for iOS/iPadOS, macOS, tvOS, and visionOS. This class of memory corruption can lead to unpredictable behavior, from denial-of-service crashes to, in worst-case scenarios, remote code execution with the privileges of the affected process.
RemediationAI
Apply the vendor updates: upgrade iOS and iPadOS to 26.6, macOS to 15.7.8 (Sequoia) or 26.6 (Tahoe), tvOS to 26.6, and visionOS to 26.6. The fixes are delivered through standard OTA or manual update processes. No viable workarounds are currently documented; given the network attack vector, restricting network access to potentially vulnerable services can serve as a temporary compensating control until patching, though this may impact necessary functionality.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
We need to output a JSON object with the specified fields, synthesizing from the provided CVE data. The input includes:
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today