EUVD-2026-78126
GHSA-vjcf-qh5g-4qrj
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from Vendor (apple) · only source for this CVE.
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. Extracting a maliciously crafted archive may allow an attacker to write arbitrary files.
AnalysisAI
Archive extraction on Apple platforms fails to properly validate path components, letting a maliciously crafted archive write files outside the intended destination directory. Affected systems include iOS and iPadOS before 26.7 (and before 27), macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and visionOS before 27, with the flaw rated CVSS 5.5 (integrity-only, local vector with required user interaction). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerabi
An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
The issue was addressed with improved memory handling. Rated critical severity (CVSS 9.8), this vulnerability is remotel
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.
A correctness issue was addressed with improved checks. Rated critical severity (CVSS 9.8), this vulnerability is remote
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today