What is the CVSS score of EUVD-2026-49547?

EUVD-2026-49547 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apple are affected by EUVD-2026-49547?

A critical buffer overflow vulnerability in macOS versions prior to 15.7.8, 14.8.8, and 26.6 could allow a malicious application to escape its sandbox, potentially leading to unauthorized system…. A patch is available.

How to fix or mitigate EUVD-2026-49547?

Within 24 hours, identify all macOS endpoints running versions 15.7.7 or earlier, 14.8.7 or earlier, and 26.5 or earlier using your asset management or MDM tools. Over the next 7 days, deploy the vendor-released patches (macOS 15.7.8, 14.8.8, or 26.6) to all affected systems, prioritizing critical assets and high-risk users. Within 30 days, verify patch compliance and audit for any residual unpatched devices, and update endpoint detection and response (EDR) rules to monitor for post-exploitation behavior.

Apple EUVD-2026-49547

| CVE-2026-43750 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-07-27 apple

GHSA-g5rh-q4ff-2c5x

RCE Buffer Overflow Apple

9.8

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (apple) · only source for this CVE.

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 15:38 vuln.today

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:13 cve.org

CRITICAL 9.8

CVE Published

Jul 27, 2026 - 20:13 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.