What is the CVSS score of EUVD-2026-49517?

EUVD-2026-49517 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apple iOS are affected by EUVD-2026-49517?

CVE-2026-43769 is a CRITICAL Denial of Service flaw in Apple's operating systems (iOS, macOS, tvOS, watchOS, visionOS) triggered by locally installed applications, with potential to cause unexpected…. A patch is available.

How to fix or mitigate EUVD-2026-49517?

Within 24 hours, audit your Apple device fleet and prioritize iOS, macOS, and other supported systems for patching based on criticality. Within 7 days, deploy the available patches (iOS/iPadOS 26.6, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS/watchOS/visionOS 26.6) to all managed Apple devices, prioritizing business-critical systems and servers first. Within 30 days, complete patch verification across all endpoints and document compliance to confirm no unpatched systems remain in your environment.

Apple iOS EUVD-2026-49517

| CVE-2026-43769 CRITICAL

Integer Overflow or Wraparound (CWE-190)

2026-07-27 apple

GHSA-cx4g-f25m-gh9h

Buffer Overflow Integer Overflow Apple Tvos Visionos Watchos Ios And Ipados

9.8

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.5 MEDIUM

Description limits this to a locally installed app causing system termination, so AV:L and PR:L with availability-only impact (A:H); no confidentiality or integrity loss is indicated.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 15:25 vuln.today

CVSS changed

Jul 28, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:13 cve.org

CRITICAL 9.8

CVE Published

Jul 27, 2026 - 20:13 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.

AnalysisAI

Denial of service in Apple operating systems (iOS/iPadOS 26.6, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS/visionOS/watchOS 26.6) allows a locally installed app to trigger an integer overflow that causes unexpected system termination. The flaw was reported and patched by Apple, and CISA's SSVC framework rates exploitation as 'none' with EPSS at just 0.17% (6th percentile), indicating no public exploit identified at time of analysis. Note a significant signal conflict: the NVD CVSS vector of 9.8 (AV:N, full C/I/A impact) is inconsistent with the description, which describes only an app-triggered crash.

Technical ContextAI

The root cause is CWE-190 (Integer Overflow or Wraparound), which Apple states was 'addressed with improved input validation.' An integer overflow occurs when an arithmetic operation produces a value exceeding the storage width of its integer type, wrapping around to an unexpected (often small or negative) value; when that value is subsequently used for memory allocation, bounds checking, or indexing, it can lead to undersized buffers and out-of-bounds access - consistent with the associated 'Buffer Overflow' tag. The CPE data confirms the defect spans Apple's shared OS foundation across ios_and_ipados, macos, tvos, visionos, and watchos, strongly implying a common framework/kernel component rather than a per-platform bug. The observed impact ('unexpected system termination') indicates the overflow reaches a critical code path whose corruption results in a kernel or system-level panic rather than a contained application crash.

RemediationAI

Apply the vendor-released patches (Patch available per vendor advisory): upgrade to iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, or watchOS 26.6 as appropriate for each device, following the platform-specific advisories at support.apple.com/en-us/128066 through 128072. Because exploitation requires a locally installed app, the most effective compensating control until patching is to restrict app installation to trusted sources - enforce MDM app allowlisting and disable sideloading/enterprise-cert app installs on managed fleets; the trade-off is reduced flexibility for users who install third-party or internal apps. There are no vendor-published configuration workarounds, so timely OS updating is the definitive fix.