EUVD-2026-77999
GHSA-35f6-77g8-cvwp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick user into running malicious app
-
DeliveryInvoke vulnerable path-handling routine
-
ExploitBypass path validation on protected location
-
ExecutionWrite to protected system files
-
ImpactTamper with OS integrity / persist
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local code execution: the attacker must get a malicious or trojanized app running on the target Apple device, then exploit weak path validation to modify files in protected system locations the app should not reach. Exploitation is limited by the need for app installation/execution (no remote unauthenticated path despite the CVSS AV:N), and is fully mitigated on iOS/iPadOS 27, macOS Golden Gate 27 / Sequoia 15.8 / Tahoe 26.7, and tvOS/visionOS/watchOS 27. No user interaction beyond running the app and no special non-default configuration is indicated. |
| Impact | The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is inconsistent with the description, which states 'An app may be able to modify protected system files' - that is a locally-installed application abusing a path-validation/permissions flaw, not a remote network attack. AV:N is almost certainly wrong; this is AV:L (an app must already be running on the device). The impact is also over-stated: the description supports Integrity (modifying protected system files) but does not describe reading data (C:H) or a crash/DoS (A:H), so those metrics are boilerplate inflation. Real-world risk signals are modest: EPSS is 0.19% (9th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so this is a high-CVSS-but-lower-real-risk issue typical of Apple's uniformly-scored advisories. It matters mainly as a sandbox/SIP-style integrity escape that could be chained for persistence, not as a standalone remotely-exploitable critical. Key conflict to verify with vendor: CVSS says network vector but the description implies local app execution. |
| Exploit ScenarioDerived | A user installs or is tricked into running a malicious or compromised app; the app leverages the path-validation weakness to write to files outside its permitted scope. This lets it tamper with protected system files, potentially establishing persistence or weakening OS integrity protections. No public exploit code is identified at time of analysis, and exploitation requires local code execution (an installed app), limiting scale. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
A locally installed app on Apple iOS/iPadOS (before 27), macOS (before Golden Gate 27, Tahoe 26.7, or Sequoia 15.8), tvOS 27, visionOS 27, and watchOS 27 can bypass insufficient path validation to modify files in protected system locations, corrupting system integrity. Exploitation requires the attacker to get a malicious or trojanized app running on the target device - there is no remote network path despite the vendor's published 9.8 network vector, and our independent assessment rates the issue CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N, with no authentication requirement and no user interaction beyond running the app. Vendor patches are available for all affected platforms, exploitation probability is low (EPSS 0.19%, 9th percentile), and no public exploit code has been identified at time of analysis.
RemediationAI
Vendor-released patch: iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 - upgrade every affected device to these builds or later via Settings > General > Software Update on iOS/iPadOS/tvOS/watchOS/visionOS and System Settings > General > Software Update on macOS, referencing the Apple advisories at support.apple.com/en-us/149034 through 149043. Because exploitation is only reachable by running a malicious or trojanized app - no remote vector and low EPSS (0.19%, 9th percentile) with no public exploit identified - prioritise updating internet-exposed and high-value endpoints first while the remainder are scheduled. Interim compensating controls carry real trade-offs: on managed fleets, enforce App Store-only or allowlisted app installation via MDM restrictions and disable developer/personal-team sideloading (reduces the attack surface but blocks legitimate internal or enterprise-signed apps); on unmanaged macOS systems, keep the app sandbox and Gatekeeper/notarization enforcement enabled and avoid granting apps Full Disk Access or administrative rights (limits impact but can break workflows that depend on those entitlements); deploy endpoint detection for app processes writing outside their container or to /System, /Library, and other protected paths (adds monitoring overhead and can generate noisy false positives). There is no indication of a network-facing workaround because the assessed attack path is local only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a permissions/path-validation defect in Apple's platform code: an application executing within the normal app sandbox can craft file paths that are not correctly canonicalized or validated, allowing it to write to protected system locations that should be reserved for the operating system or entitled processes. This breaks the containment guarantee that the sandbox and the platform's entitlement model are supposed to enforce, so the practical consequence is a local privilege/sandbox escape limited to integrity impact rather than a remote compromise. The CVE metadata carries a CWE-120 (classic buffer overflow) tag, but the vendor description explicitly frames the root cause as a permissions issue fixed with improved path validation, and our assessment aligns with the path-validation interpretation rather than memory corruption - this discrepancy is worth noting because it affects exploitability assumptions. Affected CPEs cover the full Apple ecosystem: cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:tvos, cpe:2.3:a:apple:visionos, and cpe:2.3:a:apple:watchos, all with version ranges below their respective 27 (or 26.7 / 15.8 for macOS) releases.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local malicious app so AV:L; writing to protected system files outside the app sandbox is a scope change (S:C) with high integrity impact but no described confidentiality or availability loss.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files.
Executive ViewAI
A critical file-integrity vulnerability affects Apple operating systems across the managed fleet - iOS/iPadOS, macOS, tvOS, visionOS and watchOS - and lets a locally installed application write into protected system locations, which could corrupt the OS on the device. The practical exposure requires an attacker to get a malicious or trojanized app running on the endpoint rather than a remote network path (the vendor's 9.8 network vector is not supported by our independent assessment, which rates it AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N), and no public exploit code has been identified at time of analysis. Leadership should care because remediation is a coordinated, multi-platform OS upgrade cycle touching every Apple device the organization manages, not a single-server patch, and any version-compliance gap exposes the full estate to system-integrity damage.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB