EUVD-2026-78045
GHSA-hvwm-m282-q8ff
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious 3D scene file
-
DeliveryDeliver to victim (message/web/download)
-
ExploitVictim opens or processes scene
-
ExecutionTrigger out-of-bounds write in scene parser
-
ImpactProcess crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to process a maliciously crafted 3D scene (UI:R) on an affected Apple OS version (iOS/iPadOS before 26.7 or before 27; macOS before Sequoia 15.8, Tahoe 26.7, or Golden Gate 27; tvOS/visionOS/watchOS before 27). No authentication or elevated privileges are needed (PR:N), but the attack cannot proceed without the user opening or rendering the attacker-supplied scene. Impact is limited to termination of the processing application - there is no confidentiality or integrity impact and no demonstrated path to code execution - which sharply limits real-world severity. |
| Impact | This is a low-priority, denial-of-service-only defect despite the network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, base 4.3) shows the only impact is availability, and only 'Low' - consistent with the description's 'unexpected process termination' (a single application crash, not system-wide takedown or code execution). Although the CWE is CWE-787 (out-of-bounds write), the outcome is a crash, not memory-corruption-to-RCE, so the 'Buffer Overflow'/'Memory Corruption' tags overstate the practical impact. EPSS is very low at 0.18% (8th percentile), there is no CISA KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' The AV:N rating is defensible only if a 3D scene can be delivered remotely (e.g., embedded in a message or web content), but exploitation is fundamentally gated by UI:R - a user must open/process the malicious scene - so real-world risk is targeted and self-limiting, not wormable. Net: a real but minor bug, patched by Apple, not an urgent priority. |
| Exploit ScenarioDerived | An attacker crafts a malformed 3D scene file and delivers it to a victim via message, download, or a web page that triggers scene processing. When the victim's Apple device parses the scene, an out-of-bounds write corrupts memory and the responsible process crashes. No public exploit code is identified, and the impact is limited to an application/process termination rather than code execution or data disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Out-of-bounds memory corruption in Apple's 3D scene processing pipeline lets a maliciously crafted scene file terminate the application that renders it across iOS/iPadOS, macOS, tvOS, visionOS and watchOS builds released before the fixed versions. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (score 4.3): no authentication or elevated privileges are required, but the attacker cannot succeed without the victim opening or rendering the supplied scene, and the resulting impact is confined to application termination with no confidentiality, integrity, or demonstrated code-execution effect. No public exploit identified at time of analysis, EPSS is 0.18% (8th percentile), and Apple has shipped patches for every affected platform, making this a low-priority denial-of-service defect rather than a code-execution emergency.
RemediationAI
Vendor-released patch: iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; apply via standard Apple software update and confirm version numbers against advisories https://support.apple.com/en-us/149034 through 149038 and 149041 through 149043. There is no meaningful configuration workaround because the flaw lives in the OS-level scene parsing path - the only compensating control is exposure reduction, such as stripping or quarantining untrusted 3D scene assets (e.g., USDZ/OBJ-style files) at mail and web gateways and restricting which applications and users can open externally sourced 3D content; the trade-off is that such filtering is difficult to enforce reliably, easily bypassed by renaming or repackaging files, and will break legitimate 3D and AR workflows. Given the assessed CVSS of 4.3 with availability-only impact, patching can be scheduled on a normal maintenance cadence rather than treated as an emergency, but all five OS families should be updated since a single unpatched device type remains exposed to the crafted-scene DoS.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787 (out-of-bounds write) in Apple's shared 3D scene parsing and rendering code - the same defect class appears across all five affected OS families in the CPE data (ios_and_ipados, macos, tvos, visionos, watchos), indicating a common media/scene-handling component rather than a platform-specific bug. Apple addressed the issue with improved bounds checking, meaning an attacker-controlled field or geometry value in the 3D scene data was previously allowed to write past the end of an allocated buffer, corrupting adjacent memory and causing the processing process to abort. Because the corrupted memory is not demonstrated to be reachable for controlled writes, the practical effect stays in the denial-of-service category: no read-back of memory (C:N) and no memory modification that an attacker can steer (I:N). The network attack vector reflects delivery of the scene file over a network channel, while UI:R reflects that a human must actually open or render the content before the vulnerable parser runs.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Malicious 3D scene can be delivered remotely (AV:N) but must be opened by the user (UI:R); no privileges (PR:N); only a single process crash, so C:N/I:N/A:L.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D scene may lead to unexpected process termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB