EUVD-2026-110171
GHSA-59wp-xm42-2xm4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted disk image to victim
-
ExploitUser mounts the image
-
ExecutionTrigger out-of-bounds write in kernel
-
ImpactCorrupt kernel memory or crash system
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to mount an attacker-supplied, maliciously crafted disk image on macOS - this user-initiated mount action (reflected as UI:R) is the specific, mandatory precondition; the flaw is not reachable without it. No authentication or elevated privileges are needed (PR:N). The limiting factors are significant: the attack is not automatable (SSVC Automatable=no), depends entirely on social engineering to get the user to mount the image, and the confirmed impact is availability only (system crash / kernel memory corruption) with no demonstrated code execution or data disclosure. Affected: all macOS versions below Golden Gate 27.2; fixed in macOS 27.2. |
| Impact | This is a moderate-priority issue rather than an emergency. The signals are internally consistent and all point to limited real-world risk: SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial; EPSS is low at 0.44% (38th percentile); the CVE is NOT on CISA KEV; and no public exploit or PoC reference is present in the input, so this is no public exploit identified at time of analysis. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) is availability-only - no confidentiality or integrity impact is officially claimed - and crucially it requires user interaction (UI:R): a victim must mount the attacker-supplied disk image. One point of tension worth verifying: Apple/NVD rate this AV:N, but the actual trigger (a user locally mounting a crafted .dmg) reads as a local file-handling flaw rather than a network-service flaw, so the practical attack surface is narrower than AV:N alone suggests. The vuln.today priority of 'this_month' aligns with the low EPSS and SSVC signals - patch on a normal cycle, not as a fire drill. |
| Exploit ScenarioDerived | An attacker distributes a maliciously crafted disk image (e.g. via download, email, or a shared volume) and convinces a macOS user to mount it. When mounted, an out-of-bounds write (CWE-787) in the disk-image handling path corrupts kernel memory, causing unexpected system termination (denial of service) or memory corruption. No public exploit code is identified in the available data, and success depends on the user actively mounting the image (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Apple macOS disk-image handling contains an out-of-bounds write that can corrupt kernel memory or terminate the system when a user mounts a maliciously crafted disk image. The flaw affects macOS versions before Golden Gate 27.2 and is fixed in 27.2; exploitation requires the victim to mount the crafted image (UI:R), needs no credentials (PR:N), is not automatable, and the confirmed impact is availability only, with no demonstrated code execution or data disclosure. No active exploitation is indicated and no public exploit was identified at time of analysis; EPSS is 0.44% (38th percentile), making this a moderate-priority issue rather than an emergency.
RemediationAI
Vendor-released patch: macOS Golden Gate 27.2, which Apple states fixes the out-of-bounds write through improved bounds checking; upgrade affected systems and verify the build is 27.2 or later using the Apple advisory at https://support.apple.com/en-us/149521. Until upgraded, reduce exposure by preventing users from mounting disk images obtained from untrusted or unexpected sources, since the user-initiated mount is the required trigger; this is a compensating restriction, not a complete fix, and it limits legitimate disk-image workflows. The supplied data lists no other vendor workaround, and the priority label is this_month rather than an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787, an out-of-bounds write addressed by improved bounds checking, in the code path that processes a disk image during mount. The supplied CPE cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* and EUVD range macOS 0 <27.2 identify Apple macOS below Golden Gate 27.2 as affected. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H: the mount action is user-initiated and is the mandatory precondition, no authentication or elevated privileges are required, and SSVC marks the issue non-automatable with partial technical impact. The sources do not describe the exact malformed disk-image structure or which kernel component performs the unchecked write, and they do not demonstrate code execution or data disclosure.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Triggered by a user locally mounting a crafted disk image (AV:L, UI:R), no privileges needed (PR:N); confirmed impact is system crash/kernel memory corruption, so A:H with C:N/I:N. (Apple/NVD rate AV:N.)
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Exploit-DB