EUVD-2026-77858
GHSA-xv4r-q65q-4g2x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious volume/disk image
-
DeliveryDeliver to victim (USB or download)
-
ExploitVictim mounts the volume
-
ExecutionHeap overflow in mount parser
-
ImpactUnexpected system termination (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to mount a maliciously crafted volume (disk image or removable-media filesystem) on an affected build - iOS/iPadOS before 26.7 or 27, or macOS Sequoia before 15.8, Tahoe before 26.7, or Golden Gate 27. Exploitation is gated by mandatory user interaction (UI:R): the volume must actually be attached and mounted by the target, which typically implies local or physical delivery rather than remote network reach despite the vendor's AV:N rating. Impact is limited to system termination (DoS) - no path to code execution, data disclosure, or persistence is described. |
| Impact | Real-world risk is LOW-to-MODERATE despite the 6.5 (Medium) CVSS. This is a pure availability issue - the only outcome per the description is 'unexpected system termination' (a crash/DoS), with C:N/I:N confirming no data disclosure or code execution. The vendor vector claims AV:N (network), but the described trigger is 'mounting a maliciously crafted volume,' which is a local/physical action (attaching a USB device or opening a disk image), not a network-reachable one - this AV:N vs. local-trigger mismatch should be verified with the vendor; a local vector would lower the true score. Exploitation signals reinforce low urgency: EPSS is 0.19% (9th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed actively exploited. The A:H rating is defensible here because the impact is SYSTEM (not merely app) termination, but the requirement for user interaction (UI:R - victim must mount the attacker's volume) meaningfully caps practical exploitability. Net: a routine, self-reported memory-safety hardening fix, not a priority over anything with EPSS/KEV signal. |
| Exploit ScenarioDerived | An attacker crafts a malicious disk volume (e.g., a disk image or removable-media filesystem) that triggers a heap buffer overflow in the OS mount/filesystem-parsing path. The attacker delivers it to a victim - via a downloaded .dmg, a physical USB drive, or a network share - and when the victim mounts it, the system crashes (denial of service). No public exploit code is identified at time of analysis, and the outcome is limited to a crash with no confidentiality or integrity impact. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Mounting a maliciously crafted disk image or removable-media volume on an unpatched Apple device triggers a heap buffer overflow in the operating system's volume-parsing code, causing unexpected system termination (denial of service). Affected builds are iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate 27. Exploitation is gated by mandatory user interaction - the crafted volume must be attached and mounted by the victim - and the assessed impact is limited to system termination with no code execution, data disclosure, or persistence; EPSS is only 0.19% (9th percentile) and no public exploit code has been identified, though Apple has released patched versions and CISA KEV does not list this CVE. Real-world risk is LOW-to-MODERATE despite the 6.5 (Medium) CVSS, since the practical attack path is local/physical delivery rather than network reach.
RemediationAI
Vendor-released patches are available: iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27, as documented in the Apple advisories at support.apple.com/en-us/149034, 149035, 149041, 149042, and 149043; applying the update for the appropriate platform and version is the definitive fix and should be prioritized on devices that regularly handle external or untrusted media. Until patched, the highest-value compensating control is to avoid mounting volumes of unknown provenance, including disk images (.dmg), USB drives, and SD cards, since attacker-supplied media is the sole delivery vector; where the workflow permits, disable automatic mounting of newly attached removable media so that no untrusted volume is parsed without an explicit administrative decision - the trade-off is that legitimate removable media will require manual mounting, which can disrupt backup and imaging workflows. Because impact is confined to availability (system termination) with no evidence of code execution, memory corruption, or persistence, environments that cannot immediately patch can treat this as a moderate availability risk and concentrate remediation on kiosk, shared-workstation, and physical-access-exposed fleets. Note that authentication requirements are not confirmed from the available data (the supplied vector carries PR:N, meaning no privileges are required, but mounting action by the user is still required), and no public exploit code has been identified at time of analysis, so opportunistic exploitation is unlikely and no KEV-listed activity applies.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-122 (heap-based buffer overflow) in Apple's volume/filesystem parsing path - the component that interprets partition tables and filesystem metadata when a disk image, USB volume, or other removable media is attached. What was addressed was a specific lack of bounds checking when processing attacker-controlled volume structures, so a crafted image can write past the end of a heap allocation. Successful corruption crashes the affected subsystem and takes the system down, but the available data describes no path to controlled code execution, so the realistic outcome is a reliability/availability failure. The vendor-rated vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5), which our independent assessment re-scores as AV:L because the volume must actually be mounted on the target, a prerequisite that in practice implies local or physical delivery rather than remote network access; the UI:R (user interaction) and A:H (availability-only) components are consistent with the description. The CPE data confirms the affected product families are Apple iOS and iPadOS (cpe:2.3:a:apple:ios_and_ipados) and Apple macOS (cpe:2.3:a:apple:macos), indicating a shared volume-handling component across Apple's mobile and desktop operating systems, which is why a single issue is covered by five separate Apple security advisories.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Mounting a volume is a local/physical action requiring the victim to attach it (AV:L, UI:R); no auth needed (PR:N); impact is system crash only, so A:H with C:N/I:N.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a maliciously crafted volume may lead to unexpected system termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB