EUVD-2026-77904
GHSA-4hc9-v4r7-pw4j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious file triggering heap overflow
-
DeliveryDeliver to victim (attachment/link)
-
ExploitVictim app processes file
-
ExecutionHeap buffer overflow corrupts memory
-
ImpactApplication terminates (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or process an attacker-crafted file in an affected Apple application (UI:R - user interaction is mandatory). No authentication or prior privileges are needed (PR:N), and delivery can be remote, but there is no automatic/wormable path - each attempt depends on a user action. Impact is limited to termination of the processing application on iOS/iPadOS, macOS, visionOS, or watchOS versions prior to the fixes; there is no confidentiality or integrity impact and no described code execution or system-wide crash. Fixed builds (iOS/iPadOS 26.7 and 27, macOS Golden Gate 27, visionOS 27, watchOS 27) are not vulnerable. |
| Impact | This is a low-to-moderate practical risk despite the vendor's 6.5 CVSS. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) is availability-only with no confidentiality or integrity impact, and the description caps the outcome at 'unexpected app termination' - a single application crash, not system or kernel compromise. NOTE A CONFLICT: the vendor scored A:H (high availability impact), but 'unexpected app termination' is a recoverable single-app crash and is more consistent with A:L; the A:H rating appears inflated, which is why the base score reaches 6.5 rather than ~4.3. EPSS is very low (0.18%, 8th percentile), there is no CISA KEV listing and no public POC, and it was self-reported by Apple. SSVC framing: exploitation status is none/no public exploit, automatable is unlikely (each exploit requires a victim to open a crafted file, UI:R), and technical impact is partial (denial of service only). Net: this is a routine memory-safety DoS fix, not an urgent priority. Patch during normal cycles. |
| Exploit ScenarioDerived | An attacker crafts a malicious file that triggers a heap buffer overflow in an Apple file-processing/parsing component and delivers it to a victim (email attachment, message, download, or web content). When the victim's app opens or processes the file, the overflow corrupts heap memory and the application terminates unexpectedly. No public exploit code has been identified, and the described impact is a crash rather than code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Heap-based buffer overflow in Apple's operating system platforms - iOS and iPadOS (before 26.7 and 27), macOS Golden Gate (before 27), visionOS (before 27), and watchOS (before 27) - allows a remote attacker to crash the processing application by delivering a maliciously crafted file that the victim opens. Successful exploitation requires user interaction (CVSS UI:R) and leads only to unexpected termination of the affected app; there is no confidentiality or integrity impact and no described code execution or system-wide compromise, which is why our independent assessment lowers the availability impact to A:L rather than the vendor's A:H. No public exploit code has been identified at time of analysis and exploitation is not confirmed actively exploited (CISA KEV); EPSS is 0.18% (8th percentile), indicating a low predicted likelihood of exploitation. Vendor patches are available.
RemediationAI
The primary fix is to upgrade to vendor-released patched versions: iOS 26.7 and iPadOS 26.7 (or iOS 27/iPadOS 27), macOS Golden Gate 27, visionOS 27, and watchOS 27, as documented in Apple advisories support.apple.com/en-us/149034, 149035, 149037, 149038, and 149041. Given that exploitation requires the victim to open a maliciously crafted file and that no public exploit code has been identified at time of analysis (EPSS 0.18%), patching is important but can follow normal update cycles rather than emergency change control; prioritize updating internet-facing and shared macOS systems and any device used to handle untrusted third-party files. There is no meaningful server-side workaround for the parsing flaw itself, but interim compensating controls reduce exposure: restrict automatic processing of externally sourced files (for example disable auto-preview/indexing of downloaded attachments where the OS permits) and enforce policy that untrusted files are opened only in sandboxed or isolated environments - the trade-off is reduced user convenience and possible functional impact on document workflows. Blocking network ports or endpoints is not applicable because the vector is user-driven file processing rather than a listening service. Monitor the cited advisories for any revised guidance if exploitation activity is later reported.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-122, a heap-based buffer overflow, which Apple addressed through improved bounds checking in the affected parsing code paths. In practical terms, an out-of-bounds heap write occurs when the system processes a specially crafted file, corrupting adjacent heap memory and causing the handling application to abort. The affected technology spans Apple's shared media/file-parsing stack as deployed across its product line, reflected in the CPE data: cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:visionos, and cpe:2.3:a:apple:watchos, all with version ranges below their respective fixed releases. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms a network-deliverable, low-complexity issue requiring no privileges (PR:N) but mandatory victim interaction (UI:R), with impact scoped to availability only. Our authoritative assessment retains the vector but reduces the availability impact to Low, consistent with the description's limitation to 'unexpected app termination' - no memory-disclosure (C:N) or code-execution (I:N) outcome is described, and there is no automatic or wormable propagation path since every attempt depends on the victim opening the crafted file.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Remote crafted file needs no privileges but requires the victim to open it (UI:R); impact is a single-app crash (A:L, not A:H) with no C/I loss.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. Processing a maliciously crafted file may lead to unexpected app termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB