EUVD-2026-49615
GHSA-2cpv-w8w3-mpj4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local attack, low complexity, low privileges needed; only availability impacted.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
A denial of service issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26.6. A local attacker may be able to cause a denial of service.
AnalysisAI
Denial of service in macOS Tahoe fixed by removing vulnerable code. A local attacker with low privileges can cause a denial-of-service condition. No active exploitation or public exploit known, and the low EPSS score (0.14%) indicates limited real-world risk.
Technical ContextAI
The vulnerability resides in an unspecified component of macOS, classified as an uncontrolled resource consumption (CWE-400) flaw. Exploitation requires local access with low privileges, as indicated by the CVSS vector (AV:L/PR:L). The mitigation involved removing the vulnerable code rather than patching it, implying a design-level issue that could be disabled.
RemediationAI
Upgrade to macOS Tahoe 26.6 or later, as the update removes the vulnerable code. Apply via Software Update. No workarounds are provided; restricting local access can reduce risk but full remediation requires the patch. See https://support.apple.com/en-us/128067.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today