EUVD-2026-77883
GHSA-47c6-74wg-gpg5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrojanized app installed on device
-
DeliveryApp runs and reaches vulnerable kernel path
-
ExploitCraft input triggering buffer overflow
-
ExecutionWrite controlled kernel memory / crash system
-
ImpactEscalate to kernel privileges beyond sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already have code execution on the device as an installed, running application (AV:L, PR:L) - i.e., the victim must install and run a malicious or compromised app; there is no network-remote path and no user interaction beyond running the app (UI:N). Applies to default configurations of iOS/iPadOS 26.x, macOS Tahoe 26.x, tvOS/visionOS/watchOS 26.x below 26.6 with no special feature or setting needed. Limiting factors: the local-only vector and Apple's app sandbox/notarization/App Review raise the bar for delivery, and turning the kernel-write primitive into full privilege escalation typically requires additional exploitation skill and possibly chaining with other bugs. |
| Impact | This is a genuine priority-tier local kernel bug, not a high-CVSS-but-low-risk paper finding. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) describes a low-complexity, locally-installed app that can WRITE kernel memory or cause unexpected system termination - a kernel write primitive is a classic privilege-escalation/jailbreak building block, which is why the full C:H/I:H/A:H triad is justified here rather than the availability-only or confidentiality-only ratings common elsewhere in this Apple wave. Counterbalancing signals: EPSS is only 0.16% (6th percentile), there is NO CISA KEV listing and no public POC, and Apple self-reported the flaw. So while the technical impact is severe, real-world exploitation signals are low, indicating this is a defense-in-depth/patch-promptly issue rather than evidence of active in-the-wild abuse. The attack vector is confirmed LOCAL (AV:L requires a malicious app already running on device), which meaningfully limits blast radius versus a network-reachable bug. No conflicting signals in the data: description ('An app may be able to...') is consistent with AV:L/PR:L. |
| Exploit ScenarioDerived | A user installs a malicious or compromised app that passes App Store/notarization review; when run, the app feeds crafted input to a vulnerable kernel code path, triggering a buffer overflow that either crashes the device (unexpected system termination) or writes controlled data into kernel memory. A skilled attacker chains the kernel write into a full privilege escalation to defeat the app sandbox and gain kernel-level control. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Local kernel memory corruption in Apple's 26.x operating-system family (iOS and iPadOS, macOS Tahoe, tvOS, visionOS, watchOS) allows an installed, running application to write to kernel memory or trigger unexpected system termination, with the flaw fixed in the 26.6 releases. The bug requires the victim to install and run a malicious or compromised app - it is not reachable over the network and needs no user interaction beyond launching that app (CVSS 7.8, AV:L/PR:L/UI:N) - and Apple's sandbox, notarization and App Review keep the delivery bar high, though a successful kernel-write primitive carries high confidentiality, integrity and availability impact. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS sits at 0.16% (6th percentile), indicating low near-term exploitation likelihood relative to the severity of the primitive itself.
RemediationAI
Vendor-released patches are available: upgrade to iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6 and watchOS 26.6, per Apple advisories https://support.apple.com/en-us/128066, https://support.apple.com/en-us/128067, https://support.apple.com/en-us/128068, https://support.apple.com/en-us/128069 and https://support.apple.com/en-us/128070. Because the only injection path is a locally installed and launched app (AV:L/PR:L/UI:N), there is no port to block, no network ACL and no server-side endpoint to restrict - the practical compensating controls are all about controlling which code can execute on the device, and each carries a trade-off. Enforce an MDM/declarative-device-management allowlist that permits only required App Store-validated apps and blocks sideloading, enterprise developer-signed builds and unvetted ad-hoc distributions, at the cost of reduced user flexibility and extra administrative overhead; for high-value targets, keep devices in a supervised/managed posture and delay OS-wide OTA updates only where the update window itself is the risk; and monitor endpoint telemetry for kernel panics, unexpected reboots and repeated system-termination events, which are the observable signature of a failed exploitation attempt but will not catch a successful silent kernel write. Until devices are updated, treat any suspicious installed app on a 26.x device as a potential kernel-attack vector and remove it, and note that no content filter, sandbox tweak or configuration profile restores the bounds check missing from the unpatched kernel - updating to 26.6 remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-120 (classic buffer overflow / unchecked copy), an operation that copies data into a fixed-size kernel buffer without validating length, which Apple addressed through improved memory handling - the standard euphemism for added bounds checking and hardened copy routines in XNU, the shared Darwin kernel underlying iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Because the same kernel codebase and memory-handling primitives are reused across Apple's platforms, a single defect surfaces simultaneously in every product line, which is why one CVE maps to five CPE entries (apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, apple:watchos) all in the wildcard version range below 26.6, and why the advisory references span five separate Apple support documents (128066 through 128070), one per platform. An overflow in kernel context means a malicious app can corrupt adjacent kernel structures - yielding a write-what-where-style primitive that can be leveraged toward privilege escalation outside the app sandbox - or simply crash the kernel, producing a panic and abrupt device restart. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the access model: the attacker already holds local low-privilege code execution via an installed app, exploits the bug without user interaction, and stays within the same security scope while achieving high impact across confidentiality, integrity and availability.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local malicious app (AV:L/PR:L/UI:N); kernel memory write and system crash justify full C:H/I:H/A:H; scope unchanged as impact stays within the kernel/OS boundary.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.
Executive ViewAI
Apple's 26.x operating-system family (iOS and iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS) contains a high-severity local kernel memory corruption flaw that could allow an installed malicious or compromised app to take control of the device kernel, exposing sensitive data or causing system termination. Although exploitation requires an authenticated local actor to install and launch a malicious app and no public exploit identified at time of analysis, a successful kernel-write primitive could have significant confidentiality, integrity, and availability consequences for affected users. Apple has released fixed 26.6 versions, so leadership should prioritize fleet-wide patching of all impacted Apple devices to reduce organizational exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB