EUVD-2026-77968
GHSA-c5j7-4gfm-qj3w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
ExploitApp invokes vulnerable system interface
-
ExecutionTrigger uncaught exception (CWE-248)
-
ImpactUnexpected system termination (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
| Exploitation Conditions | Requires a malicious application to be installed and run locally on the target Apple device (iOS/iPadOS 26.7 or 27, macOS Golden Gate 27 / Tahoe 26.7, tvOS/visionOS/watchOS 27); the app invokes a system interface that fails to handle input safely and raises an uncaught exception. Exploitation is limited to causing a crash/system termination - no confidentiality or code-execution impact is described. The primary limiting factor is that the attacker must first get an app onto the device and executed, and the payoff is only denial of service (transient reboot/termination), which sharply reduces real-world attractiveness despite the 7.5 rating. |
| Impact | This is a genuine but low-priority issue. The vendor CVSS of 7.5 is inflated by two questionable metric choices: (1) AV:N (network) contradicts the description 'An app may be able to cause unexpected system termination,' which describes a locally installed app as the attacker - this strongly implies AV:L, not remote network exploitation; verify with Apple's advisory. (2) The vector scores I:H/A:N (integrity impact, no availability impact), yet the sole described consequence is 'unexpected system termination' - a crash/DoS that is an availability impact (A:H), not an integrity one. This mislabeling likely props up the 7.5. Corroborating the low real-world risk: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code is identified. CWE-248 (uncaught exception) is consistent with a crash-only bug rather than code execution or data disclosure. Net: a legitimate, vendor-patched local denial-of-service with no confidentiality or code-execution impact - patch during normal cycles, not an emergency. |
| Exploit ScenarioDerived | A user installs a malicious or trojanized app on an Apple device; when run, the app sends malformed input to a system component whose uncaught exception forces the operating system to terminate unexpectedly, producing a denial of service. No public exploit code is identified, and the impact is limited to a crash - no data exposure or code execution is described. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Improper handling of unexpected runtime conditions in Apple's operating systems lets a locally installed malicious app trigger an uncaught exception that terminates the system - a denial-of-service/crash impact with no confidentiality or code-execution effect. Affected platforms are iOS and iPadOS before 26.7 and before 27, macOS Tahoe before 26.7 and macOS Golden Gate before 27, plus tvOS 27, visionOS 27 and watchOS 27; the attacker must first get an app onto the device and execute it, and the payoff is only a transient system termination. There is no public exploit code and no confirmed active exploitation, EPSS is 0.18% (7th percentile), and Apple has shipped fixed versions, so this should be treated as a genuine but low-priority issue requiring routine patch cadence rather than emergency response.
RemediationAI
Vendor-released patches are available: upgrade to iOS 26.7 or iOS 27, iPadOS 26.7 or iPadOS 27, macOS Tahoe 26.7 or macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27, as documented in Apple's advisories (https://support.apple.com/en-us/149034 through 149042). No configuration switch disables the affected interface, so patching is the only complete fix; for fleets that cannot update immediately, the practical compensating control is to restrict software installation to allowlisted, reviewed applications on supervised/MDM-managed devices, which raises the bar for delivering the malicious app but costs end-user flexibility and does not help if a hostile app is already installed, and it does nothing against a user who can sideload. Because exploitation is local-app driven, availability-only, has no public exploit code and carries an EPSS of 0.18% (7th percentile), remediation can follow a normal patch window rather than an emergency change; monitor for repeated unexpected device terminations or reboots as a weak indicator of attempted triggering.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-248 (Uncaught Exception): a system interface reachable from an application performs insufficient validation or 'improved checks' were missing, so malformed or unexpected input raises an exception that propagates to the top of the process and aborts it - on Apple platforms this manifests as a system termination rather than a contained app crash. The affected CPEs span Apple's entire current OS family (apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, apple:watchos), meaning the defect sits in a shared framework or system service present across all of them rather than in a single app. NVD scores this 7.5 with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, but our independent assessment is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - the trigger path requires a malicious application to be installed and run locally, authentication is not required (PR:N), and the realized impact is availability only. No elevation of privilege, memory corruption, data disclosure or remote code execution is described in the vendor text, so the higher network/integrity interpretation should not be relied upon for prioritization.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
'An app may be able to' indicates a local installed-app vector (AV:L, PR:N, UI:N); the only impact is unexpected system termination, so A:H and C:N/I:N.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
The issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
Executive ViewAI
Apple operating systems-including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS-contain a vulnerability that allows a locally installed malicious app to crash affected devices, causing temporary availability disruption but no data exposure or code execution. No public exploit identified at time of analysis, and Apple has shipped fixed versions. Leadership should treat this as a routine patch-management issue for Apple endpoints rather than an emergency.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB