EUVD-2026-110238
GHSA-vc88-xrh2-49mj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted content or malicious app
-
DeliveryUser opens affected content
-
ExploitTrigger out-of-bounds write
-
ExecutionCorrupt process memory
-
ImpactUnexpected system termination
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a crafted or malicious app to run on the device (per 'An app may be able to...'), or - per the supplied CVSS vector - attacker-supplied content that the user must interact with (UI:R). Impact is limited to availability/stability: the flaw can crash the system or corrupt process memory, with no confirmed confidentiality or integrity loss (C:N/I:N). Limiting factors: the description scopes this to an app-level trigger, user interaction is required by the vector, and it is fixed across all current branches - iOS/iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.2 - so patched devices are not exposed. |
| Impact | This is a moderate-severity, availability-focused memory-safety flaw (CWE-787 out-of-bounds write) in Apple's operating systems, and the signals converge on treating it as routine patch-cycle work rather than an urgent fire. The input CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) scores 6.5 with impact limited to availability (A:H) and no confidentiality or integrity loss. EPSS is low at 0.55% (46th percentile), SSVC reports Exploitation: none, Automatable: no, and Technical Impact: partial, and there is no CISA KEV listing and no public exploit reference - consistent with the vuln.today 'this_month' priority rather than act_now/emergency. One notable conflict: the CVSS vector encodes AV:N (network) with UI:R, but Apple's description ('An app may be able to cause unexpected system termination or corrupt process memory') reads as a locally installed malicious or buggy app, which would normally be a local (AV:L) vector - verify the true attack surface with Apple, because this affects whether the threat is remote content or a sideloaded/malicious app. Likewise, impact is rated A:H (availability) even though 'corrupt process memory' hints at a possible integrity dimension not reflected in the vector. Overall: a real but non-priority issue - patch on the normal monthly schedule. |
| Exploit ScenarioDerived | A malicious or malformed application (or, per the network vector, crafted content the user is induced to open) triggers an out-of-bounds write in an affected Apple OS component, corrupting process memory and causing unexpected system termination. No public exploit identified at time of analysis, and the realistic outcome is a crash/denial of service rather than confirmed code execution or data theft. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
An out-of-bounds write (CWE-787) in Apple's operating systems - iOS and iPadOS, macOS Sequoia, macOS Tahoe, macOS Golden Gate, and visionOS - allows a crafted or malicious app, or attacker-supplied content that a user interacts with, to trigger memory corruption and unexpected system termination. The impact is availability-focused: the supplied vector (PR:N/UI:R, C:N/I:N/A:H) and the independent assessment agree that confidentiality and integrity are not confirmed as affected, while system stability and process memory are. There is no KEV listing and no public exploit code identified at time of analysis, EPSS is low at 0.55% (46th percentile), and CISA SSVC rates exploitation as none and automatable as no, so this is routine patch-cycle work rather than an emergency; Apple fixed it with improved input validation across all current branches.
RemediationAI
Apply the vendor-released patch: update to iOS 26.7.2 or iPadOS 26.7.2 (or iOS/iPadOS 27.2), macOS Tahoe 26.7.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and visionOS 27.2 - deployment details are in Apple's advisories at https://support.apple.com/en-us/149227, https://support.apple.com/en-us/149230, https://support.apple.com/en-us/149521, https://support.apple.com/en-us/149522, https://support.apple.com/en-us/149523 and https://support.apple.com/en-us/149526. Patch availability is confirmed by the vendor and the priority signal is this_month rather than immediate, so the update can be scheduled in the normal cycle while unpatched devices remain exposed to a crash or memory-corruption condition triggered by a malicious app or by attacker-supplied content requiring user interaction. No vendor-documented workaround is provided in the available sources; because the reported impact is availability-only and the trigger is scoped to an app or user interaction, limiting installation of untrusted apps and avoiding untrusted content on unpatched devices reduces exposure until the update is applied, though Apple's position in equivalent advisories is that updating is the complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is an out-of-bounds write (CWE-787), a memory-safety class in which a write operation exceeds the bounds of the intended buffer, corrupting adjacent memory. Apple's advisory states the issue was addressed with improved input validation, which points to missing or insufficient length/range checks on data reaching the affected code path rather than a logic flaw in a named protocol or library; the specific component, subsystem, and precise trigger are not described in the available sources. No privilege escalation, code-signing bypass, or sandbox-escape primitive is claimed - the assessed outcome is denial of service (system termination) and process memory corruption. The CPE data uses wildcard version ranges (cpe:2.3:a:apple:ios_and_ipados, apple:macos, apple:visionos), so exposure is version-based across Apple's OS family, with EUVD enumerating fixes at iOS/iPadOS 26.7.2 and 27.2, macOS 26.7.2, 27.2 and 15.8.2, and visionOS 27.2.
Know when Visionos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Apple's 'an app may be able to' phrasing points to a local malicious app (AV:L/UI:N) needing no special privileges (PR:N); memory corruption gives I:L and system termination gives A:H, with no confidentiality impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt process memory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerabi
A denial of service vulnerability in This (CVSS 4.2). Risk factors: actively exploited (KEV-listed).
A logic issue was addressed with improved state management. Rated critical severity (CVSS 9.8), this vulnerability is re
An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab
Exploit-DB