Apple macOS CVE-2026-65396

Exploitation requires the attacker to already be able to execute a malicious or compromised application locally on the macOS host (consistent with AV:L and 'An app may be able to...'); it is not remotely reachable. The specific API or system component that performs the insufficient size validation is not named by Apple. Limiting factors: the attacker needs an app running on the device (so initial access/code execution is a prerequisite), impact is confined to availability (unexpected system termination/DoS) with no data disclosure or modification, and running a fully patched build (macOS 27, 15.8, or 26.7) removes the flaw.

This is a moderate, low-priority issue that the combined signals consistently rate as such - there is no conflict between sources. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a locally-exploitable availability-only flaw: an attacker must already be running code on the machine (a malicious or compromised app) and the only outcome is unexpected system termination (a crash/DoS), with no confidentiality or integrity impact and no scope change. All corroborating signals point the same direction: EPSS is very low at 0.21% (11th percentile), the CVE is NOT on CISA KEV, no public exploit code was identified, and CISA SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial. There is no data conflict to flag - the CVSS local vector, the 'An app may be able to...' description, and the SSVC 'none/no/partial' decision all agree this is a local denial-of-service requiring prior code execution, not a remotely weaponizable critical. The practical priority is low: patch in the normal maintenance cycle. The only limiting nuance worth verifying is the exact privilege level the triggering 'app' needs, which the description does not specify beyond requiring local app execution.

A user installs or is tricked into running a malicious application (or an already-present app is compromised); the app issues a crafted request that overflows an undersized buffer in a macOS system component. Because size validation was insufficient, the overflow corrupts memory and forces an unexpected system termination (kernel panic or service crash), denying availability. No public exploit code was identified at time of analysis, and because CVSS is AV:L the attacker must already have local code execution on the target.