EUVD-2026-77869
GHSA-m547-233x-8mw8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
ExploitApp invokes crafted operation
-
ExecutionTrigger memory-handling defect
-
ImpactCause unexpected system termination
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the ability to run a malicious or malformed application on the target device (local access, PR:L per the CVSS vector) across default configurations of iOS/iPadOS or macOS; no user interaction beyond running the app and no network access is involved. Exploitation is LIMITED to devices running versions prior to the fixes (iOS/iPadOS before 26.7 or 27, macOS before Golden Gate 27 / Sequoia 15.8 / Tahoe 26.7) and yields only a crash/reboot - there is no code execution, privilege escalation, or data access, and remote exploitation is not possible. |
| Impact | This is a genuine but low-priority issue. All signals agree it is a local, availability-only denial-of-service, not a code-execution or data-disclosure flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) yields 5.5 (Medium), driven entirely by A:H - C:N and I:N confirm no confidentiality or integrity impact. Exploitation requires local access via an already-installed app running with at least low privileges (PR:L). Threat-intel signals reinforce low urgency: EPSS is 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit code was identified. The one contradiction worth flagging is metadata rather than scoring: the 'Information Disclosure' tag is inconsistent with the C:N vector - this is a DoS bug, not a disclosure bug. Overall this is a high-volume-but-low-real-risk maintenance fix typical of Apple's coordinated OS releases; patch on the normal cycle rather than as an emergency. |
| Exploit ScenarioDerived | A user installs a malicious or malformed app from a local source; when run, the app issues a crafted operation that triggers the memory-handling defect and forces unexpected system termination (a crash/reboot). No public exploit code exists, and the impact is limited to disrupting device availability rather than gaining code execution or accessing data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Improper memory handling in Apple iOS, iPadOS, and macOS lets a locally running application trigger an unexpected system termination, crashing the device or the operating system; affected versions are iOS/iPadOS prior to 26.7 or 27, and macOS prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The only prerequisite is the ability to run a malicious or malformed app on the target device (local access, PR:L, no user interaction and no network reachability), and the demonstrated impact is limited to availability - no code execution, privilege escalation, or data access. No public exploit identified at time of analysis, no evidence of active exploitation (not in CISA KEV), EPSS is 0.20% (10th percentile), and vendor patches have been released.
RemediationAI
Vendor-released patch: iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7; apply these updates via standard Apple software update or MDM-pushed OS updates, using the advisories at https://support.apple.com/en-us/149034, https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149041, https://support.apple.com/en-us/149042, and https://support.apple.com/en-us/149043 to map each platform to its fix. Because exploitation requires only the ability to run a malicious or malformed app locally with no user interaction, compensating controls are inherently limited and secondary: enforce MDM/configuration profiles that restrict app installation to managed or App Store-vetted sources so untrusted or sideloaded binaries cannot reach the vulnerable code path, accepting reduced flexibility for developers and power users; on macOS, keep Gatekeeper and notarization requirements enabled and prune unnecessary local user accounts to shrink the set of principals who can satisfy the PR:L prerequisite, though neither measure removes the underlying defect. Network-based mitigations such as blocking ports or disabling services provide no benefit here, since the vector is strictly local. Upgrade priority is low: EPSS is 0.20% (10th percentile), the issue is not in CISA KEV, no public exploit code has been identified, and the worst-case outcome is a crash or reboot rather than code execution or data compromise.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
At its core this is a memory-handling defect in Apple's shared iOS/iPadOS/macOS codebase: crafted input from a locally installed application drives the affected component into a malformed memory state, and the resulting fault is escalated to an unexpected system termination rather than being contained to the app sandbox. The source data assigns no CWE, but the root-cause class is consistent with improper memory handling / out-of-bounds memory access (the CWE-119/CWE-787 family), and the CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms a purely local, low-complexity, availability-only bug: confidentiality and integrity impacts are None, scope is unchanged, and the attack is not network-reachable. The CPE entries cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:* and cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* identify the affected product families, with EUVD enumerating the vulnerable ranges as iOS/iPadOS before 26.7 and before 27, macOS before Golden Gate 27, before Sequoia 15.8, and before Tahoe 26.7. Note a tagging inconsistency in the source data: the record is tagged "Information Disclosure," yet the description and the assessed vector both describe an availability-only denial-of-service condition with no confidentiality impact, so the DoS interpretation should be treated as authoritative.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
A locally installed app triggers the flaw (AV:L, PR:L), impact is only unexpected termination (A:H) with no confidentiality or integrity effect (C:N/I:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB