EUVD-2026-78028
GHSA-rfc2-rvfg-g74x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local code execution via app
-
DeliveryInvoke vulnerable kernel path
-
ExploitTrigger memory corruption (CWE-119)
-
ExecutionCorrupt kernel memory / escalate
-
ImpactSystem termination or privilege gain
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access with the ability to execute code on the device - the attacker must already run an app or process on the affected iOS/iPadOS or macOS system (AV:L, PR:L, UI:N). No user interaction and no network vector; exploitation is against default configurations but is fundamentally gated by needing prior on-device foothold, which is why this is realistically a privilege-escalation/sandbox-escape stage rather than an initial-access vector. Limiting factors: patched builds (iOS/iPadOS 26.7 & 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27) fully remediate it, and no public exploit currently lowers the barrier. |
| Impact | This is a genuine but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) correctly reflects a locally-exploitable memory-corruption flaw with high impact but no remote reach - an attacker must already be running code on the device (e.g. a sandboxed or unprivileged app). EPSS is very low at 0.16% (6th percentile), the CVE is NOT in CISA KEV, and no public exploit code is identified, so the signals are internally consistent: high technical impact (kernel memory corruption / privilege boundary) but low likelihood of widespread opportunistic exploitation. Under an SSVC lens, technical impact is 'total' (kernel memory) but exploitation is 'none' observed and not readily automatable from a network position. There are no conflicting signals here - the local attack vector matches the description ('A local attacker'). The realistic concern is targeted use as a local privilege-escalation / sandbox-escape link in an exploit chain (a common role for Apple kernel bugs) rather than mass exploitation; prioritize patching on high-value or shared endpoints. |
| Exploit ScenarioDerived | A malicious or compromised app already running on an iPhone, iPad, or Mac triggers the memory-handling flaw in the affected kernel component, corrupting kernel memory to escalate privileges or crash the system. No public exploit code exists at time of analysis, but Apple kernel memory-corruption bugs of this type are frequently weaponized as the local-privilege-escalation stage of a broader chain. Because the flaw is local (AV:L), the attacker needs code execution on the device first, e.g. via a downloaded app or a prior remote bug. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 18, 2026
Kernel memory corruption in Apple's iOS, iPadOS, and macOS allows a local attacker who can already execute code on the device to cause unexpected system termination or corrupt kernel memory, as described by the vendor's improved memory handling fix. Affected builds are iOS and iPadOS before 26.7 (and before 27), plus macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27; all are remediated by the corresponding vendor updates. Exploitation requires a prior on-device foothold (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so this realistically functions as a privilege-escalation or sandbox-escape stage rather than an initial-access vector - no public exploit has been identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV listing), and EPSS is low at 0.16% (6th percentile). It is a genuine but not top-tier priority: the impact is high if chained, but the barrier of local code execution limits reach.
Earlier versions of this analysis (1)
Kernel memory corruption in Apple iOS, iPadOS, and macOS allows a locally executed malicious app to cause unexpected system termination or corrupt kernel memory, potentially leading to further compromise. The buffer overflow (CWE-119) in memory handling affects iOS/iPadOS before 26.7 and 27, and macOS before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. Apple has released patches; no public exploit has been identified (EPSS 0.16%), though the independent assessment rates it as one of the more serious issues in the October 2026 Apple advisory wave.
RemediationAI
Vendor-released patch: update to iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 - the fixed builds named by Apple, with details in the advisory set at https://support.apple.com/en-us/149034, https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149041, https://support.apple.com/en-us/149042, and https://support.apple.com/en-us/149043. Because this is a kernel memory-handling defect, no meaningful configuration workaround exists for an unpatched device, so patch latency is the primary control; until a device can be updated, compensating measures should focus on denying the prerequisite local foothold. Enforce strict app-source restrictions (App Store only, block sideloading and unmanaged profiles) and MDM application allowlisting to shrink the pool of code that can run on-device, at the cost of flexibility for developers and power users. Restrict physical and remote access to managed devices, and treat jailbroken/rooted or non-compliant endpoints as untrusted on corporate networks and to sensitive cloud resources, which reduces the chaining value of a local kernel primitive but does not eliminate the bug. If rapid patching is infeasible fleet-wide, prioritize the highest-value devices - executive, administrative, and security staff - and monitor for reboot loops, kernel panics, and unexpected process termination patterns as possible exploitation indicators, accepting that such telemetry is noisy and cannot reliably confirm a local kernel attack. All of these are compensating controls with real trade-offs, not substitutes for the vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-119 (improper restriction of operations within the bounds of a memory buffer), addressed by Apple through improved memory handling - the classic pattern for an out-of-bounds or overflow-style defect in the kernel's memory management path. The CVSS vector confirms local access (AV:L), low privileges (PR:L), no user interaction (UI:N), and unchanged scope, with high confidentiality, integrity, and availability impact; that combination is characteristic of the XNU kernel and its supporting subsystems, where a non-privileged process can reach a memory-handling routine that mangles kernel memory and thereby crashes the system (panic) or potentially overwrites kernel structures. The CPE strings (cpe:2.3:a:apple:ios_and_ipados:* and cpe:2.3:a:apple:macos:*) and the ENISA EUVD affected-version ranges (iOS/iPadOS <26.7 and <27; macOS <15.8, <26.7, and <27) show that the same shared code base is affected across Apple's mobile and desktop operating systems, which is typical of a common kernel component rather than an app-layer bug. Because the attacker must already be running code on the target, the practical exploitation model is chaining: an initial remote or user-assisted compromise is escalated into kernel-level access or used to disable the device.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attacker running code on-device (AV:L, PR:L, UI:N); kernel memory corruption yields high confidentiality, integrity, and availability impact within the same OS scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A local attacker may be able to cause unexpected system termination or corrupt kernel memory.
Executive ViewAI
A kernel memory corruption flaw affects Apple's iOS, iPadOS, and macOS fleets, including macOS Sequoia, Tahoe, and Golden Gate builds, and can cause forced device restarts or kernel-level compromise on any device where an attacker has already gained a foothold. Because exploitation requires pre-existing local code execution, this is primarily a privilege-escalation or sandbox-escape stepping stone rather than a direct entry point, meaning the practical risk is elevated for high-value targets such as executives and administrators whose devices are most likely to be attacked in multiple stages. Leadership should treat this as a scheduled remediation item within the normal patch cycle, not an emergency, since no public exploit has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB