EUVD-2026-77886
GHSA-gfgq-c542-cgmq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted 3D model to victim
-
DeliveryVictim opens/processes model file
-
ExploitInteger overflow in parser
-
ExecutionMemory corruption in handling process
-
ImpactPotential arbitrary code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to process a maliciously crafted 3D model file on an affected Apple OS (iOS/iPadOS before 26.7 or 27, macOS Sequoia before 15.8 / Tahoe before 26.7 / Golden Gate 27, tvOS/visionOS/watchOS before 27). The limiting factors are user interaction (UI:R - the target must open, preview, or otherwise parse the malicious model) and local delivery of the file; there is no remote unauthenticated network path. No special product configuration is needed beyond running an unpatched version with the affected 3D-model parsing code (e.g., Quick Look / Model I/O style asset handling), so any default installation is affected once a malicious model is processed. |
| Impact | This is a genuine but moderate-priority memory-corruption vulnerability, not a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, 7.3) describes a local, low-complexity flaw that requires user interaction (opening/processing a malicious 3D model) and asserts full C:H/I:H/A:H impact consistent with exploitable memory corruption. Real-world exploitation signals are LOW: EPSS is only 0.20% (10th percentile), there is no CISA KEV listing, and no public POC is identified - so this is not confirmed exploited and appears low-likelihood at scale. A notable INCONSISTENCY: the vendor vector uses PR:L, but the described attack (a victim processing a crafted 3D model file) requires no attacker privileges on the target - PR:N/UI:R is the more defensible modeling, which would nudge the score slightly higher rather than lower. The AV:L is reasonable since exploitation hinges on locally processing a file rather than a remote network service, but delivery is trivial (email/web/AirDrop a model file). Net: patch-worthy given ubiquitous Apple footprint and high technical impact, but the missing exploitation evidence keeps it below actively-exploited memory-corruption bugs in the same advisory batches. |
| Exploit ScenarioDerived | An attacker crafts a malformed 3D model file that triggers an integer overflow during parsing, corrupting memory in the handling process. The victim receives the file (web download, message attachment, AirDrop) and opens or previews it on an affected iPhone, iPad, Mac, Apple TV, Vision Pro, or Apple Watch, leading to memory corruption that could be developed into code execution. No public exploit code is identified at time of analysis, and exploitation requires user interaction to process the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Memory corruption during 3D model parsing on unpatched Apple platforms (iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8 / Tahoe before 26.7 / Golden Gate 27, and tvOS, visionOS, watchOS before 27) allows an attacker who can get a victim to open or preview a maliciously crafted 3D model file to corrupt memory, potentially leading to code execution in the context of the parsing process with high confidentiality, integrity, and availability impact. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.3), so the practical barrier is user interaction - the target must parse the crafted asset locally; there is no remote unauthenticated network path, and no public exploit code has been identified at time of analysis (EPSS 0.20%, 10th percentile). Apple has shipped fixes; this is a genuine but moderate-priority issue rather than a top-tier emergency, since exploitation depends on social engineering plus a locally delivered file.
RemediationAI
Vendor-released patches are available: update iOS and iPadOS to 26.7 or 27, macOS Sequoia to 15.8, macOS Tahoe to 26.7, macOS Golden Gate to 27, tvOS to 27, visionOS to 27, and watchOS to 27. Apple's per-platform advisories are at support.apple.com/en-us/149034, 149035, 149036, 149037, 149038, 149041, 149042, and 149043; enterprise fleets should prioritize macOS and iOS/iPadOS endpoints, since those are the platforms most likely to receive untrusted 3D assets from the internet, email, or messaging apps, while tvOS/visionOS/watchOS updates should follow on the normal cadence. Because exploitation requires the victim to actually process the crafted model (UI:R) and the file must be delivered locally, the practical interim controls are to treat 3D model files as untrusted content: block or quarantine untrusted .usdz/.obj/.dae and similar model attachments at mail and web gateways, disable or restrict rich Quick Look/preview generation for downloaded assets where a configuration profile allows it, and instruct users not to open model files from unknown senders - the trade-off being reduced preview convenience and possible false positives on legitimate design or AR workflows that regularly exchange 3D assets. Restricting local parsing of model files via sandboxing or an endpoint policy that blocks third-party model viewers can further shrink exposure, at the cost of breaking legitimate 3D authoring and review use cases. No public exploit code was identified at time of analysis and EPSS is low (0.20%, 10th percentile), so this should be scheduled alongside other Apple security updates rather than treated as an emergency out-of-band change.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-190 (Integer Overflow or Wraparound) in Apple's 3D model/asset parsing pipeline - the code path used by frameworks such as Model I/O and by system preview surfaces like Quick Look when rendering assets such as USDZ, OBJ, or similar scene/model formats. A crafted model supplies attacker-controlled size, count, or offset fields that are combined in an arithmetic operation without adequate bounds checking; the resulting wrapped or truncated value leads to an undersized allocation or an incorrect index, after which data is written past the end of the buffer. That is why this advisory is tagged both Integer Overflow and Buffer Overflow, with memory corruption as the observable outcome. The vulnerability is reachable on any default installation that processes 3D assets, since no special configuration is required beyond running an unpatched OS version. The CPE data confirms broad coverage across the Apple platform family - cpe:2.3:a:apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, and apple:watchos - indicating a shared parsing library rather than a single app-level defect, which is consistent with one fix being published simultaneously across nine OS update advisories (Apple support articles 149034 through 149043). The assessed vector differs from the NVD-published vector only in privileges (PR:N versus PR:L); per the authoritative assessment, no privileges are required on the attacker's part, the only prerequisite being that the victim interact with the malicious file (UI:R).
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack is local file processing (AV:L) needing no attacker privileges (PR:N over vendor's PR:L) but victim interaction (UI:R); integer overflow yields exploitable memory corruption with high C/I/A.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D model may lead to memory corruption.
Executive ViewAI
Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS contain a memory corruption vulnerability (CVE-2026-84620) in 3D model parsing that can lead to code execution when a user opens a malicious file. Although exploitation requires user interaction and no public exploit has been identified at time of analysis, the flaw affects a broad range of Apple devices used across the organization, potentially compromising confidentiality, integrity, and availability of sensitive data. Leadership should prioritize patching because the attack vector is local but relies on social engineering, and a successful exploit could allow attackers to run code in the context of the parsing process.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB