EUVD-2026-15123Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Impact | The real-world risk assessment is constrained by limited technical data: no CVSS score, vector, or EPSS exploitation probability has been publicly assigned, making quantitative risk scoring impossible. However, several qualitative signals indicate moderate priority: the vulnerability affects Apple's entire installed base across six major operating system families, affects multiple recent OS versions simultaneously, and is specifically addressed through patching across all platforms suggesting broad impact. The attack vector requires a malicious application, implying users must install untrusted software or attackers must compromise legitimate apps, which mitigates some risk compared to network-based exploits. The stated impact is denial-of-service rather than code execution or data exfiltration, lowering severity, though DoS can impact device usability and system stability. Without KEV (Known Exploited Vulnerability) status confirmation or public proof-of-concept, there is no indication of active exploitation in the wild. The primary risk is to users who install compromised applications from unofficial sources or sideload apps, while users relying on App Store distribution face reduced risk due to Apple's code review process. |
| Exploit ScenarioDerived | An attacker distributes a malicious application (either through social engineering on unofficial app stores or through compromise of a legitimate developer account) that contains specially crafted input designed to trigger the stack overflow vulnerability. When a user installs and runs the app, the malicious code sends specific data structures or makes system calls with oversized parameters that cause a stack buffer to overflow, corrupting adjacent stack memory and crashing the application or the entire operating system, resulting in a denial-of-service condition. This attack requires user action (app installation) but no special device privileges, making it a practical vector against users who bypass App Store restrictions or fall victim to app distribution compromises. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are vulnerable to a stack overflow vulnerability that can be triggered by user interaction with a malicious app, potentially causing denial-of-service conditions. The vulnerability stems from insufficient input validation and affects multiple recent OS versions across Apple's product ecosystem. While no patch is currently available, users should exercise caution when installing apps from untrusted sources.
Earlier versions of this analysis (1)
A stack overflow vulnerability in Apple's operating systems across multiple platforms (iOS, iPadOS, macOS, tvOS, visionOS, and watchOS) has been addressed through improved input validation. An attacker can exploit this vulnerability through a malicious app to cause a denial-of-service condition, though the specific attack vector and exploitation complexity remain undisclosed. The vulnerability affects a broad range of Apple products across its entire ecosystem, with patches available across multiple OS versions including iOS 18.7.7, iPadOS 18.7.7, macOS Sequoia 15.7.5, and corresponding releases for tvOS, visionOS, and watchOS.
RemediationAI
Immediate remediation requires upgrading to the patched versions: iOS and iPadOS 18.7.7 or later (or 26.4 and later for the newer branch), macOS Sequoia 15.7.5 or later (or macOS Tahoe 26.4 and later), tvOS 26.4 or later, visionOS 26.4 or later, and watchOS 26.4 or later. Users should enable automatic security updates in their device settings to receive these patches promptly. Until patches can be applied, administrators and users should restrict installation of applications from untrusted sources and avoid sideloading unsigned or unverified applications. For enterprise deployments, Mobile Device Management (MDM) solutions should be configured to enforce minimum OS versions and prevent installation of applications from unauthorized sources. Refer to the detailed remediation steps in Apple's support articles linked in the affected products section for platform-specific patching procedures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability involves a stack overflow condition, which occurs when a program writes more data to a stack buffer than its allocated size, causing the stack to overflow and potentially overwrite adjacent memory. The root cause is classified under CWE (Common Weakness Enumeration) for buffer overflow or improper input validation. The affected products span Apple's entire platform ecosystem as indicated by the CPE strings: iOS and iPadOS (cpe:2.3:a:apple:ios_and_ipados), macOS (cpe:2.3:a:apple:macos), tvOS (cpe:2.3:a:apple:tvos), visionOS (cpe:2.3:a:apple:visionos), and watchOS (cpe:2.3:a:apple:watchos). The vulnerability requires malicious application code to trigger the stack overflow through crafted input, suggesting the weakness exists in a shared system library or framework used across these platforms rather than in individual apps.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to cause a denial-of-service.
Executive ViewAI
Organizations using A stack overflow should be aware of moderate risk from CVE-2026-28852, a input validation vulnerability rated CVSS 5.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
Remote code execution in Google Chrome for iOS prior to 156.0.8078.47 is possible when a victim opens a crafted HTML pag
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared,
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
GitHub PoC
Exploit-DB