What is the CVSS score of EUVD-2026-49468?

EUVD-2026-49468 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-49468?

Yes, a patch is available for EUVD-2026-49468. Update the affected software to the latest version immediately.

macOS EUVD-2026-49468

| CVE-2026-28981 HIGH

Classic Buffer Overflow (CWE-120)

2026-07-27 apple

GHSA-hx6f-whc9-5pw7

RCE Buffer Overflow Apple

7.8

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector, low complexity, no privileges needed after user interaction to open a crafted file.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:R/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 15:23 vuln.today

CVSS changed

Jul 28, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:12 cve.org

HIGH 7.8

CVE Published

Jul 27, 2026 - 20:12 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Processing a maliciously crafted image may lead to arbitrary code execution.

AnalysisAI

Arbitrary code execution in Apple macOS through image processing is fixed in macOS Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6. A buffer overflow in handling maliciously crafted images allows local attackers to execute arbitrary code with the victim's privileges upon opening the file. No active exploitation or public proof-of-concept is reported; EPSS predicts low exploitation probability (0.19%).

Technical ContextAI

The vulnerability is a classic buffer overflow (CWE-120) in the image parsing components of macOS, likely within the ImageIO framework or a related library. When processing a specially crafted image file, insufficient bounds checking can overflow a buffer, permitting an attacker to overwrite adjacent memory and hijack execution flow. The CPE identifier 'cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*' confirms that all macOS versions prior to the fixed releases are affected across the product line.

RemediationAI

Apply the vendor patch by upgrading to macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, or macOS Tahoe 26.6 or later. No workarounds are provided; the only mitigation is to avoid opening untrusted image files until the update can be applied. Detailed upgrade instructions are in the Apple security advisories referenced.