EUVD-2026-77879
GHSA-6gxc-cmrj-vhj3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall/run malicious app on device
-
ExploitInvoke vulnerable API with crafted object
-
ExecutionTrigger type confusion in memory handling
-
ImpactUnexpected system termination (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service Proxy/intermediary controls
|
| Exploitation Conditions | Requires a locally-present, already-executing app on the target Apple device (PR:L, AV:L, UI:N) - the attacker must first get code running as an app on iOS/iPadOS, macOS, tvOS, visionOS, or watchOS. No remote network vector and no user interaction beyond running the app. Limiting factors: attacker needs prior app installation/execution on the device, exploitation yields only denial of service (unexpected system termination) with no data access or code execution, and the affected OS must be unpatched (below iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, tvOS/visionOS/watchOS 27). |
| Impact | This is a genuine but low-priority issue. All availability-only signals align: the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5 Medium) describes a locally-installed, already-running malicious app that can trigger a type confusion causing unexpected system termination - a denial-of-service with no confidentiality or integrity impact. EPSS is very low (0.17%, 7th percentile), it is NOT in CISA KEV, and no public exploit code has been identified. The impact is bounded: 'unexpected system termination' is a crash/reboot, not code execution or privilege escalation. The one clear data conflict is the assigned CWE-441 (Unintended Proxy/Confused Deputy), which does not match the described type-confusion memory-handling flaw - that is textbook CWE-843 (Type Confusion); this looks like a CWE assignment error rather than a substantive risk signal. The 'Information Disclosure' tag also contradicts the vector (C:N), so it appears mislabeled. Net: a real vulnerability worth patching in routine cycles, but not an emergency given local access + low-privilege app prerequisite, DoS-only impact, and no exploitation evidence. |
| Exploit ScenarioDerived | A user installs or is tricked into running a malicious or compromised app on an Apple device. The app feeds crafted input to a vulnerable system component, triggering a type-confusion condition that Apple fixed with improved memory handling, causing the device to unexpectedly terminate/restart. No public POC or in-the-wild exploitation is known; impact is limited to denial of service on the local device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Unexpected system termination (denial of service) is possible on unpatched Apple platforms after a locally installed, already-executing app triggers a type confusion in OS memory handling - affecting iOS/iPadOS before 26.7 and before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27. The flaw is strictly local: the attacker must first get code running as an app on the device (AV:L, PR:L, UI:N per the assessed CVSS:3.1 vector), and successful exploitation produces only a crash with no confidentiality or integrity impact (C:N/I:N/A:H, base score 5.5). Apple has released patches, exploitation yields denial of service only, and no public exploit code or CISA KEV listing has been identified at time of analysis; EPSS is low at 0.17% (7th percentile).
RemediationAI
Vendor-released patches are available and should be applied: iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 - update each affected device family to at least its corresponding fixed version using the Apple advisories https://support.apple.com/en-us/149034 through https://support.apple.com/en-us/149043 as the authoritative deployment reference. Because exploitation requires an already-installed, already-running app on the device (AV:L/PR:L) and yields only a system crash, patching can be scheduled at normal cadence rather than treated as emergency; where immediate update is not possible, compensating controls are to enforce MDM/App Store-only installation and notarization policies so untrusted or sideloaded apps cannot reach the device, and to remove or block unapproved applications - the trade-off being reduced user flexibility and possible disruption of internal enterprise apps that are not distributed through managed channels. Restricting which apps may execute meaningfully raises the attacker's prerequisite cost, but it does not eliminate the flaw, since any permitted app that triggers the type confusion still causes an unexpected system termination, so the fixed OS version remains the only complete mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a memory-safety defect in Apple's operating system kernel/userspace components, described by the vendor as a type confusion addressed through improved memory handling - i.e. an object or pointer is interpreted as an incompatible type, corrupting internal state badly enough to terminate the system. The CVE is classified under CWE-441 (Unintended Proxy or Intermediary, 'Confused Deputy'), a root-cause class in which a privileged intermediary is tricked into acting on behalf of a less-privileged caller; combined with the type-confusion description, this suggests a component that mishandles a caller-supplied object reference and crashes the process or kernel rather than executing attacker code. Affected CPEs cover the whole Apple OS family under a single identifier: apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos and apple:watchos. The assessed vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms a local, low-privilege, no-user-interaction attack that is scope-unchanged and impacts availability only - no data disclosure or code execution is demonstrated, which is consistent with the vendor's 'unexpected system termination' wording and the low EPSS score.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local low-privilege app triggers the flaw (AV:L/PR:L/UI:N); impact is availability-only system termination (A:H, C:N, I:N), no scope change.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB