EUVD-2026-49554
GHSA-fpvq-93x4-j4x7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted network payload
-
DeliveryTrigger buffer overflow in vulnerable system component
-
ExploitCorrupt heap memory
-
ExecutionExecute arbitrary code with process privileges
-
ImpactGain full device control
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of affected Apple OS versions. The CVSS vector (AV:N/PR:N/UI:N) indicates that no user interaction or authentication is necessary, making this a low-complexity network attack. |
| Impact | The vendor-assigned base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to network-based, low-complexity, unauthenticated exploitation with complete loss of confidentiality, integrity, and availability. The EPSS prediction is 0.26% (18th percentile), suggesting low immediate exploitation likelihood. SSVC analysis marks exploitation as none, automatable, and total technical impact. Despite the critical CVSS rating, the absence of active exploitation (not in CISA KEV) and low EPSS signal that this is currently a high-severity but not actively targeted vulnerability. |
| Exploit ScenarioDerived | A remote attacker sends a specially crafted network packet to an exposed system service that processes the data without proper bounds checking, overwriting heap memory and causing either an immediate crash or, in successful exploitation, execution of arbitrary code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause application termination or arbitrary code execution. Affected products include iOS and iPadOS prior to version 26.6, macOS before Sequoia 15.7.8 and Tahoe 26.6, tvOS before 26.6, and visionOS before 26.6; no active exploitation or public proof-of-concept has been reported.
RemediationAI
Apply the vendor updates: upgrade iOS and iPadOS to 26.6, macOS to 15.7.8 (Sequoia) or 26.6 (Tahoe), tvOS to 26.6, and visionOS to 26.6. The fixes are delivered through standard OTA or manual update processes. No viable workarounds are currently documented; given the network attack vector, restricting network access to potentially vulnerable services can serve as a temporary compensating control until patching, though this may impact necessary functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from a buffer overflow (CWE-119) in an unspecified Apple operating system component where improper bounds checking allows unauthenticated remote attackers to overwrite heap memory. The vulnerability is present in all supported Apple platforms, as indicated by CPE records for iOS/iPadOS, macOS, tvOS, and visionOS. This class of memory corruption can lead to unpredictable behavior, from denial-of-service crashes to, in worst-case scenarios, remote code execution with the privileges of the affected process.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated buffer overflow likely yields arbitrary code execution; Apple's CVSS assigns full impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
3DescriptionCVE.org
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB