EUVD-2026-77887
GHSA-hx7m-466v-g933
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker publishes/sideloads malicious app
-
ExploitApp feeds crafted input to vulnerable component
-
ExecutionTrigger out-of-bounds read (CWE-125)
-
ImpactMemory corruption forces unexpected system termination
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have a malicious application running locally on the target Apple device - matching AV:L and PR:L (the app executes with its own app-level privileges). No user interaction beyond running the app is needed (UI:N). The realistic limiting factor is that Apple's app sandbox and App Store/notarization review constrain how a hostile app reaches and executes on a victim device; the payoff is limited to a crash/reboot (denial of service) with no data exposure or code-execution escalation. Patched by updating to iOS/iPadOS 26.7 or 27, macOS Golden Gate 27 / Sequoia 15.8 / Tahoe 26.7, or tvOS/visionOS/watchOS 27. |
| Impact | This is a genuinely low-to-moderate priority issue despite the CVSS 5.5 medium rating. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) describes a purely availability-impacting flaw - an already-installed local app can trigger an out-of-bounds read (CWE-125) causing unexpected system termination, with NO confidentiality or integrity impact (C:N/I:N). EPSS corroborates low real-world risk at 0.21% (11th percentile), and there is no CISA KEV listing and no public exploit code, so this is not under active exploitation. The description ('An app may be able to cause unexpected system termination') aligns cleanly with the A:H-only vector, so the signals are consistent rather than conflicting. Note a tag/impact tension: the input carries an 'Information Disclosure' tag, but the vendor vector explicitly sets C:N - the realized impact is denial of service, not disclosure, so the tag overstates the confidentiality effect. Bottom line: real but modest - a local crash/DoS primitive requiring attacker-controlled code already running on the device, not a remotely-weaponizable critical bug. |
| Exploit ScenarioDerived | An attacker publishes or sideloads a malicious application onto a victim's Apple device (iPhone, iPad, Mac, Apple TV, Vision Pro, or Watch). When run, the app feeds crafted input to the vulnerable component, triggering an out-of-bounds read that corrupts memory and forces unexpected system termination (a crash/reboot). No public proof-of-concept exists, and the attack yields only denial of service, not data theft or code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
A memory-safety defect (out-of-bounds read, CWE-125) in Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS can be triggered by a locally running application and causes an unexpected system termination - a denial-of-service/availability impact with no confidentiality or integrity loss. Affected versions are those prior to the fixed releases: iOS/iPadOS before 26.7 (and before 27), macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS, visionOS, and watchOS before 27. Exploitation requires the attacker to already have a malicious app running on the device with its own app-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, scored 5.5); no public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and there is no CISA KEV entry. Apple has released patched versions, so the practical exposure is limited to unpatched devices running a hostile app - a low-to-moderate priority issue.
RemediationAI
Vendor-released patch: update to iOS 26.7 or iOS 27 (and iPadOS 26.7 or 27), macOS Sequoia 15.8 or macOS Tahoe 26.7 or macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 as applicable; per-device install instructions and per-platform details are in Apple's advisories (https://support.apple.com/en-us/149034, 149035, 149036, 149037, 149038, 149041, 149042, 149043). Because the vector requires a locally executing hostile app (AV:L/PR:L/UI:N) and the outcome is limited to system termination, the largest practical mitigation is platform hygiene rather than network controls: keep App Store/notarization and managed-device policies enforcing app review, restrict sideloading and unvetted enterprise/MDM app distribution (trade-off: reduces legitimate developer and enterprise flexibility), and remove or block known-bad or unsigned applications on high-availability endpoints. There is no meaningful network-perimeter workaround for an on-device memory-safety bug, and MDM-restricting app installation introduces operational friction for users who legitimately install non-App-Store software. Where patching must be deferred, prioritize updating devices used in kiosk, point-of-sale, or other availability-sensitive roles, since a crash/reboot is the concrete impact; no public exploit code has been identified at time of analysis, so deferral is defensible under normal risk tolerance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is an out-of-bounds read (CWE-125), a memory-corruption class in which code reads past the end of an allocated buffer because length or bounds validation is missing or insufficient. Per Apple's advisory language, the issue was addressed with improved memory handling, meaning the fix adds or tightens bounds checking rather than changing the affected feature set. The vulnerability lives in a system component reachable from the application context (the local app attack vector, AV:L, with the attacking process holding low privileges, PR:L, and no user interaction, UI:N), which is consistent with a sandboxed app invoking a vulnerable API or service. CPE data covers the Apple OS families uniformly - apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, and apple:watchos - indicating a shared code base or framework across all platforms rather than a single-product defect. Because the assessed scope is S:U and only availability is impacted (C:N/I:N/A:H), a successful trigger results in a crash/termination rather than memory disclosure or code execution, though the tags referencing information disclosure and buffer overflow reflect the general risk class of out-of-bounds reads if adjacent memory were ever returned to the attacker.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
A locally-running malicious app (AV:L, PR:L) reliably triggers an OOB read causing system termination (A:H) with no confidentiality/integrity impact (C:N/I:N); matches the vendor vector.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB