EUVD-2026-110113
GHSA-hq2w-pr84-vg8f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted disk image to victim
-
DeliveryUser mounts malicious image
-
ExploitOut-of-bounds write in kernel parser
-
ExecutionCorrupt kernel memory / panic
-
ImpactDenial of service or memory corruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to mount a maliciously crafted disk image on an affected macOS version (any build before macOS Tahoe 26.7.2 or macOS Golden Gate 27.2); the flaw is in the kernel's handling of the mounted image. The key limiting factor is required user interaction (UI:R) - the attacker cannot trigger it without the user choosing to mount the attacker-supplied image - which substantially constrains scalability. Confirmed impact is availability only (unexpected system termination / kernel panic), with possible kernel memory corruption; no authentication is required (PR:N) once the image is presented to the user. |
| Impact | This is a moderate-priority, not emergency, issue and the signals are internally consistent. Apple's CVSS of 6.5 reflects a crash/memory-corruption impact (A:H) gated behind user interaction (UI:R), with no confidentiality or integrity scored (C:N/I:N). EPSS is low at 0.46% (40th percentile), there is no CISA KEV listing, and SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial - all pointing away from active or scalable exploitation. The vuln.today decision label is 'this_month', i.e. scheduled patching rather than drop-everything. One tension to verify: Apple scores AV:N, but the described trigger is mounting a crafted disk image, which in practice requires a local user action to mount the file; AV:L would arguably better fit the mechanism, so the 'network' label likely reflects that the image can be delivered remotely rather than remote exploitation without any local step. No public exploit identified at time of analysis, so the realistic risk is a user being tricked into mounting a malicious image, yielding a denial of service (kernel panic) and possible kernel memory corruption. |
| Exploit ScenarioDerived | An attacker delivers a maliciously crafted disk image (for example via download, email attachment, or a shared volume) and convinces the user to mount it. When macOS parses the image, an out-of-bounds write corrupts kernel memory, causing an unexpected system termination (kernel panic) and potentially further memory corruption. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
An out-of-bounds write in the macOS kernel's handling of mounted disk images lets a maliciously crafted image corrupt kernel memory or crash the system when a user mounts it. All macOS builds prior to Tahoe 26.7.2 and Golden Gate 27.2 are affected. The flaw is rated 6.5 (CVSS 3.1) by the vendor-facing sources, but exploitation requires the victim to mount the attacker-supplied image (UI:R) and confirmed impact is availability only, so this is a moderate-priority issue rather than an emergency: there is no CISA KEV listing, SSVC reports no known exploitation, EPSS is 0.46% (40th percentile), and no public exploit code was identified at time of analysis.
RemediationAI
Install the vendor fix: upgrade to macOS Tahoe 26.7.2 or macOS Golden Gate 27.2, which contain the corrected bounds checks, following Apple's advisories at https://support.apple.com/en-us/149521 and https://support.apple.com/en-us/149522. A vendor patch is confirmed available, so no compensating control is required for hosts that can be updated, and the scheduler classifies this as a this-month priority rather than an emergency. Because the only confirmed path to exploitation is a user choosing to mount a maliciously crafted disk image, reducing the volume of untrusted disk images presented to users on unpatched machines limits exposure until the update is applied; the provided sources describe no other workaround or configuration change.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a CWE-787 out-of-bounds write in macOS kernel code that processes disk images at mount time; Apple addressed it with improved bounds checking. The affected CPE is the generic apple:macos platform entry, meaning the bug sits in a shared kernel component rather than an optional app, so any supported build below the fixed releases is exposed. The supplied sources do not identify the specific kernel subsystem, image format parser, or the exact sequence of operations that overruns the buffer, so the precise trigger beyond "mount a crafted disk image" is not described in the available sources. NVD publishes an AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H vector (6.5), whereas the independent assessment places the vector at AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H; the two agree that the requirement for the user to mount the image (UI:R) is the dominant constraint, and that the demonstrated outcome is kernel panic or unexpected system termination with possible kernel memory corruption, no confidentiality impact, and no authentication prerequisite once the image is presented.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Triggered by locally mounting a supplied disk image, so AV:L with UI:R and PR:N; kernel memory corruption gives I:L and the described crash gives A:H, with no confidentiality impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB