EUVD-2026-77892
GHSA-3f7c-vf68-fcmq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted image on web/message
-
ExploitVictim opens/previews image
-
ExecutionImage parser reads uninitialized memory
-
ImpactProcess memory fragments disclosed to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization checks
|
| Exploitation Conditions | Exploitation requires the victim to process a maliciously crafted image on an affected, unpatched Apple OS (iOS/iPadOS before 26.7 or 27, macOS Sequoia before 15.8 / Tahoe 26.7 / Golden Gate 27, tvOS/visionOS/watchOS before 27). No authentication or special configuration is needed (PR:N, default configurations), but user interaction is required (UI:R): the target must open, preview, or otherwise let the system decode the attacker-supplied image. The impact is limited to disclosure of uninitialized process memory (C:L only) - no code execution, integrity, or availability effect - so realistic risk is constrained to leaking small, non-deterministic memory fragments rather than a full compromise. |
| Impact | This is a genuinely low-to-moderate priority issue, and the multiple signals agree on that. The CVSS 3.1 base score is 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) - network-deliverable but requiring user interaction, with only a partial confidentiality impact (C:L) and no integrity or availability effect. EPSS reinforces the low urgency at 0.18% (8th percentile), indicating minimal predicted exploitation activity. There is no CISA KEV listing and no public POC identified. The impact is bounded: leakage of uninitialized process memory (CWE-457) that may expose small, non-deterministic fragments of data rather than granting code execution or full memory read primitives. The one caveat is scale rather than severity - this affects essentially the entire Apple client-OS fleet, so even a low-severity leak has a very large attack surface. On balance this is patch-in-normal-cycle, not an emergency: a real but constrained information-disclosure bug, not a high-CVSS-but-fictional risk nor an actively exploited threat. No signals conflict; all point to low real-world risk mitigated by the required user interaction. |
| Exploit ScenarioDerived | An attacker crafts a malicious image and delivers it to a victim via a website, message, or email attachment; when the victim's Apple device processes/renders the image, uninitialized process memory is read into the decoded output and disclosed to the attacker. No public exploit code has been identified, and successful exploitation depends on the user opening or previewing the attacker-supplied image (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Processing a maliciously crafted image on unpatched Apple platforms can leak uninitialized process memory, exposing small, non-deterministic fragments of data that happened to be in memory at decode time. Affected are iOS and iPadOS before 26.7 and before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, plus tvOS, visionOS, and watchOS before 27; the CVSS vector (AV:N/AC:L/PR:N/UI:R) means no credentials or special configuration are needed but the victim must open, preview, or otherwise trigger decoding of the attacker-supplied image. Impact is limited to confidentiality (C:L) with no integrity or availability effect, EPSS is a low 0.18% (8th percentile), and no public exploit has been identified at time of analysis; Apple has shipped fixed versions for every affected platform, so the practical priority is routine patch cadence rather than emergency response.
RemediationAI
Vendor-released patches exist for every affected platform: upgrade iOS and iPadOS to 26.7 or 27, macOS Sequoia to 15.8, macOS Tahoe to 26.7, macOS Golden Gate to 27, and tvOS, visionOS, and watchOS to 27 - Apple's per-platform advisories are at support.apple.com/en-us/149034 through 149043, and the fix is described as improved memory initialization. Because exploitation requires the victim to process a crafted image (UI:R) and impact is limited to uninitialized memory disclosure (C:L, no code execution), this can be handled in a normal update cycle rather than as an emergency; the main operational risk is fleet fragmentation across macOS 15.x/26.x/27.x and users who defer OS upgrades on older hardware. Where devices cannot be updated immediately, compensating controls should target the decode trigger: strip or re-encode untrusted images at email and web gateways so malformed files never reach the endpoint decoder (trade-off: legitimate image fidelity loss and added latency for all attachments), or disable automatic preview and thumbnail generation for untrusted content on managed macOS hosts - restrict Quick Look previews, Spotlight indexing of untrusted volumes, and automatic attachment previews in Mail/Messages (trade-offs: reduced user productivity, and iOS/iPadOS/watchOS/visionOS offer no equivalent central control, so those devices rely on timely OS updates). There is no patch to apply instead of the OS update and no configuration flag that fully removes the exposure, so the fixed OS builds remain the only complete remediation; EPSS of 0.18% and the absence of any identified public exploit mean deferring a week or two for change-window purposes is defensible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-457, use of uninitialized memory, in the system image-decoding path: a buffer used to store decoded or transformed pixel data is read before it is fully initialized, so bytes left over from earlier allocations can be returned to the caller and rendered or exfiltrated through the resulting image. Because the disclosure follows a memory-safety primitive rather than a logic flaw, what leaks is inherently non-deterministic - heap layout, prior allocations, and platform allocator behavior determine whether anything sensitive is exposed, and the CVSS impact is capped at C:L with no code execution, integrity, or availability component. The CPE data identifies the affected code as shipping inside the core Apple operating system distributions themselves (cpe:2.3:a:apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, apple:watchos), consistent with a shared media/imaging framework that is reused across all of Apple's OS families rather than a standalone application; the advisory set does not name the specific framework or symbol, but the multi-platform, multi-version fix pattern is typical of Apple's shared media parsing stack. The attack surface is therefore any code path that decodes untrusted images - Mail and Messages attachments, Safari image rendering, Quick Look previews, thumbnailers, and third-party apps using system image APIs - and the fix is improved memory initialization (zeroing/initializing buffers) applied across all supported release trains.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Image is remotely deliverable (AV:N) and easily crafted (AC:L) with no auth (PR:N), but requires the user to open it (UI:R); only partial memory disclosure (C:L), no I/A impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An uninitialized memory issue was addressed with improved memory initialization. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may result in disclosure of process memory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB