EUVD-2026-77873
GHSA-299p-r48g-p3q2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious remote input
-
DeliveryDeliver to vulnerable Apple component
-
ExploitTrigger out-of-bounds write
-
ExecutionCorrupt application memory
-
ImpactCrash app or execute code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The description attributes exploitation to a 'remote attacker' causing an out-of-bounds write, but does not name the specific component, protocol, file format, or feature involved, nor whether victim interaction (e.g., opening or processing malicious content) is required. Affected are unpatched builds prior to iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; updating to these versions removes the flaw. Limiting factors: the confirmed impact is only an application crash (DoS), reliable arbitrary code execution is unproven, and the exact triggering surface is undocumented, so real-world exploitability beyond DoS cannot be assessed from available data. |
| Impact | Signals conflict on whether this is a top-tier priority. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) and SSVC (Automatable:yes, Technical Impact:total) paint a worst-case picture, but SSVC Exploitation is 'none' and there is no CISA KEV entry and no public POC, so 'no public exploit identified at time of analysis.' EPSS is 0.99% (61st percentile) - modest, consistent with a freshly-disclosed Apple memory-corruption bug that is not yet weaponized. Critically, the description hedges the outcome: 'may be able to cause unexpected app termination OR arbitrary code execution' - meaning the CONFIRMED impact is a DoS crash, while remote code execution is stated as a possibility, not a demonstrated result. This is the key caveat against taking the 9.8 at face value: the I:H/C:H components rest on unproven RCE. Unlike Apple's many local 'an app may cause termination' UAF bugs, this one is explicitly attributed to a 'remote attacker,' so AV:N is genuinely defensible here rather than overstated. Net: real and worth patching promptly across the Apple fleet given ubiquity and remote reach, but not yet an emergency in the KEV sense - treat as high-priority-patch, not active-incident. |
| Exploit ScenarioDerived | A remote attacker delivers maliciously crafted data to a vulnerable Apple device (e.g., via a network service or content processed by an affected component), triggering an out-of-bounds write that corrupts memory. In the confirmed case this crashes the target application (DoS); if the attacker can shape the heap/write primitive reliably, it could escalate to arbitrary code execution. No public exploit or POC has been published, and the RCE outcome is characterized by Apple as a possibility rather than demonstrated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate), tvOS, visionOS, and watchOS - lets a remote attacker corrupt memory in an affected process, with the confirmed outcome being an application crash and the potential outcome being arbitrary code execution. Exploitation requires no authentication and no user interaction per the CVSS vector (AV:N/PR:N/UI:N), but the independent assessment rates attack complexity as High and the confirmed technical impact as limited to denial of service, because the specific component or content-processing surface that must be reached has not been documented and reliable code execution is unproven. Apple has released fixed builds for every affected platform, and no public exploit code or active exploitation has been identified at time of analysis; EPSS is a modest 0.99% (61st percentile), which is consistent with a patched, non-weaponized memory-safety defect rather than a top-tier emergency.
RemediationAI
Vendor-released patch: update to iOS 26.7 or iOS 27, iPadOS 26.7 or iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, as documented in the Apple advisories (support.apple.com/en-us/149034 through 149043). Because the vulnerable component is unnamed and the trigger path is undocumented, no precise feature-disable or port-block workaround can be recommended; the reliable mitigation is prompt installation of the fixed builds across all managed Apple devices, prioritising internet-facing or high-value endpoints where a memory-corruption crash could be chained with other bugs. If immediate fleet-wide patching is not feasible, compensating controls are necessarily blunt: restrict network exposure of Apple services and reduce processing of untrusted content (for example, limit automatic handling of externally sourced media or documents, and constrain who can send such content to your users), accepting that these measures reduce but do not eliminate risk and may degrade legitimate workflows. No public exploit code has been identified, so emergency out-of-band change windows are not indicated by the current intelligence, but the trivial-fix nature of a version upgrade and the breadth of affected product lines still justify treating this within a normal patch cycle rather than deferring.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a classic out-of-bounds write (CWE-787), the memory-corruption class in which a program computes a length or index incorrectly and writes past the end of an allocated buffer, overwriting adjacent heap or stack memory. Apple's advisory language - 'addressed with improved bounds checking' - confirms this is a bounds-validation defect in a system library or system service rather than a logic or configuration error, and the associated tags (RCE, Buffer Overflow, Memory Corruption) align with that classification. Such defects are typically triggered when a parser processes attacker-supplied data (network protocol, media file, or document format), which would explain the network attack vector and the 'remote attacker' framing; however, the advisories do not name the vulnerable component, protocol, or file format, so the exact attack surface is undocumented. The CPE data is intentionally coarse - apple:ios_and_ipados and apple:macos with no version qualifiers, plus apple:tvos, apple:visionos, and apple:watchos - meaning version-level scoping must come from the EUVD affected-version list (iOS/iPadOS before 26.7 and before 27, macOS before 15.8, before 26.7, and before 27, tvOS before 27, visionOS before 27, watchOS before 27). The vendor CVSS of 9.8 assumes low complexity and total impact, whereas the independent assessment (AV:N/AC:H/PR:N/UI:N/C:L/I:L/A:H) treats the exploit path as difficult and the demonstrated impact as a crash, so the practical severity sits well below the headline 9.8.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote per Apple (AV:N) but RCE only 'may be'-possible so AC:H and C:L/I:L; confirmed impact is app-termination DoS (A:H).
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A remote attacker may be able to cause unexpected app termination or arbitrary code execution.
Executive ViewAI
Apple's operating system family (iOS/iPadOS, macOS, tvOS, visionOS, and watchOS) is impacted by a critical memory corruption vulnerability that can be triggered remotely without authentication or user interaction, leading to application crashes and potential arbitrary code execution. While no public exploit identified at time of analysis, the broad deployment of these devices in organizational environments means a successful exploit could disrupt operations and compromise data. Leadership should prioritize patching to mitigate the risk of productivity loss and security breaches.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB