EUVD-2026-110344
GHSA-9wv9-38gm-3q7c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted image to target
-
ExploitVictim app processes image
-
ExecutionTrigger out-of-bounds write
-
ImpactUnexpected app termination (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to process a maliciously crafted image in an affected app, so success depends on user interaction (UI:R) - the attacker cannot trigger the crash without the target opening or rendering the attacker-supplied image. The flaw affects iOS/iPadOS before 26.7.2 and before 27.2, macOS before 15.8.2 / before 26.7.2 (Tahoe) / before 27.2 (Golden Gate/Sequoia branch), and visionOS before 27.2; patched versions are not affected. The available sources do not name the specific image format or decoding component involved, and the only confirmed outcome is application termination (denial of service), which limits realistic impact to availability of the affected app. |
| Impact | This is a moderate, not top-tier, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) describes a network-reachable flaw with low complexity and no privileges, but it requires user interaction and its ONLY impact is availability (C:N/I:N/A:H) - consistent with the description, which limits the outcome to 'unexpected app termination' (a crash/DoS) rather than code execution or data compromise. The signals are coherent and all point to limited urgency: EPSS is low at 0.58% (48th percentile), there is no CISA KEV listing, and CISA SSVC scores Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. The vendor-aligned priority is 'this_month', not act_now or emergency. No exploit or PoC reference is present in the input, so there is no evidence of exploit availability. The one caveat for defenders: CWE-787 (out-of-bounds write) is a memory-corruption class that can sometimes be escalated beyond a crash, but nothing in the supplied evidence indicates this instance achieves more than denial of service, and the C:N/I:N impact metrics reflect that. Treat as routine patch-cycle work rather than an emergency. |
| Exploit ScenarioDerived | An attacker delivers a maliciously crafted image (for example via a message, web page, or email attachment) to a target running an affected Apple OS. When the victim's app processes or renders the image, an out-of-bounds write is triggered, causing the application to terminate unexpectedly (denial of service). No public exploit or PoC reference is present in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
An out-of-bounds write in Apple's image handling on iOS/iPadOS, macOS and visionOS can terminate the affected application when a user opens a maliciously crafted image, giving an availability-only denial-of-service outcome (CVSS 6.5, C:N/I:N/A:H). The attacker cannot trigger the fault directly: exploitation requires the victim to process the crafted file in an affected app, as reflected by the UI:R vector component, and macOS is affected across three branches (Sequoia before 15.8.2, Tahoe before 26.7.2, Golden Gate before 27.2) while iOS/iPadOS is affected before 26.7.2 and before 27.2 and visionOS before 27.2. Apple has released fixes for all listed platforms with improved bounds checking; no public exploit identified at time of analysis, EPSS is 0.58% (48th percentile), and CISA SSVC rates exploitation as none with partial technical impact, making this a moderate, not top-tier, priority.
RemediationAI
Vendor-released patches are available: update iOS and iPadOS to 26.7.2 or 27.2, macOS Sequoia to 15.8.2, macOS Tahoe to 26.7.2, macOS Golden Gate to 27.2, and visionOS to 27.2; those versions contain the improved bounds checking that removes the out-of-bounds write. Advisory details and download links are in the Apple security documents at https://support.apple.com/en-us/149227, https://support.apple.com/en-us/149230, https://support.apple.com/en-us/149521, https://support.apple.com/en-us/149522, https://support.apple.com/en-us/149523 and https://support.apple.com/en-us/149526. The supplied sources do not document a workaround or configuration-level mitigation for this issue, and the only stated impact is application termination after an attacker-supplied image is processed, so exposure before patching is bounded by the requirement that a user open the crafted image - the practical interim measure is to prioritise the update on devices and Macs that routinely handle image files from untrusted sources, consistent with the this_month remediation priority rather than emergency handling.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787, an out-of-bounds write in memory handling code reached while processing image data; Apple's advisory language attributes the fault to insufficient bounds checking and states that it was addressed by improving that checking. Because the vector is AV:N/AC:L/PR:N/UI:R/S:U with C:N/I:N/A:H, the realistic consequence described in the supplied sources is memory corruption that manifests as unexpected application termination - availability loss within the context of the vulnerable app - rather than code execution or data disclosure. The sources do not name the specific image format, decoder, framework (for example ImageIO or CoreGraphics) or code path involved, and the trigger beyond 'processing a maliciously crafted image' is not described in the available sources; likewise the exploitability traits that would explain the low attack complexity (AC:L) in mechanism terms are not documented. Affected builds enumerated by the CPE data (apple:ios_and_ipados, apple:macos, apple:visionos) and the EUVD version ranges confirm the flaw is present across Apple's mobile, desktop and spatial-computing platforms, which typically share imaging code, and patched builds are not affected.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Crafted image is network-deliverable (AV:N) and needs no privileges, but the victim must process it (UI:R); only outcome described is app termination, so C:N/I:N/A:H.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may lead to unexpected app termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB