EUVD-2026-77907
GHSA-w925-7fg2-g46m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious file
-
DeliveryDeliver to victim (email/web/message)
-
ExploitVictim opens file in app
-
ExecutionOut-of-bounds write in parser
-
ImpactUnexpected app termination (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or process an attacker-supplied maliciously crafted file in a vulnerable Apple app (UI:R) on an unpatched device running iOS/iPadOS before 26.7 or 27, macOS before 15.8/26.7/27 (Golden Gate 27), tvOS before 27, or visionOS before 27. No authentication or elevated privileges are needed (PR:N), but the attack cannot proceed without user interaction and delivery of the crafted file. The realized impact is limited to termination of the processing application - there is no confidentiality or integrity effect and no system-wide crash - which sharply limits practical severity. |
| Impact | This is a genuinely low-priority issue despite the memory-corruption class. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L: although the flaw is an out-of-bounds write (CWE-787, often a code-execution primitive), Apple's own impact statement caps the realized outcome at 'unexpected app termination' - i.e. availability-only (A:L), with no confidentiality or integrity impact (C:N/I:N). EPSS reinforces low real-world risk at 0.20% (10th percentile). There is no CISA KEV listing and no public proof-of-concept, so exploitation status is 'no public exploit identified at time of analysis.' The one notable tension: CVSS declares AV:N (network) yet the vector requires UI:R and processing of a malicious file - practically this means the user must open/receive attacker-supplied content, so the 'network' vector is really delivery-of-a-file rather than direct remote reach. No SSVC decision data was supplied. Net: a plausibly-triggerable crash, not a demonstrated RCE, in patched Apple software - low urgency. |
| Exploit ScenarioDerived | An attacker crafts a malformed file (e.g. a document, image, or media asset) and delivers it to a victim via email, message, web download, or AirDrop. When the victim opens or previews the file on an unpatched Apple device, the parser performs an out-of-bounds write and the handling app crashes. No public exploit code exists, and the described impact is limited to app termination rather than code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
An out-of-bounds write in Apple's operating systems - iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7 and before Golden Gate 27, tvOS before 27, and visionOS before 27 - allows a remote, unauthenticated attacker to crash the application that processes a maliciously crafted file, with the flaw addressed through improved bounds checking. Successful exploitation requires the victim to open or process the attacker-supplied file (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), and the realized impact is limited to termination of the processing app with no confidentiality or integrity effect and no system-wide crash. Vendor patches are available from Apple across all affected platforms, the EPSS score is low at 0.20% (10th percentile), and no public exploit has been identified at time of analysis. This is a genuinely low-priority issue despite the memory-corruption class.
RemediationAI
Apply the vendor-released patches: update to iOS 26.7 and iPadOS 26.7 (or iOS 27 and iPadOS 27), macOS Sequoia 15.8 (or macOS Tahoe 26.7 / macOS Golden Gate 27), tvOS 27, and visionOS 27, as documented in Apple advisories https://support.apple.com/en-us/149034 through https://support.apple.com/en-us/149043. Prioritize by exposure rather than by severity: because exploitation only yields an app crash (no data theft or code execution per the assessed vector), this is a routine update cycle item rather than an emergency patch, so roll it into the next scheduled Apple OS maintenance window - but do not skip it entirely, since same-class bounds-checking bugs are sometimes revisited by researchers for escalation. No workaround is offered by the vendor and there is no feature toggle or configuration that removes the vulnerable parsing path, so the only reliable mitigation is patching. In the interim, reduce delivery of crafted files: block or sandbox untrusted document and media attachments at the mail and web gateway, strip high-risk file types from inbound email, and restrict users from opening files from unverified sources in apps that parse external content. Fleet-management controls (MDM enforcement of minimum OS versions, blocking of unmanaged devices from sensitive resources) add real friction against the user-interaction precondition, at the cost of administrative overhead and possible disruption for users on older hardware that cannot take the newest major release - in that case at minimum apply the point-release fixes (26.7, 15.8, 26.7) that are available for the current major version. Monitor endpoint telemetry for repeated unexplained application terminations, which is the observable symptom of a successful trigger.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787, an out-of-bounds write, which Apple states was resolved with improved bounds checking. This places the bug in the memory-corruption family: a parser or file-processing code path writes past the end of an allocated buffer when handling crafted input, corrupting adjacent memory rather than merely reading it. That corruption class can theoretically be escalated to code execution, but Apple's own CVE record and the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L vector describe only a local availability effect - the affected app terminates - with no integrity or confidentiality impact and an unchanged (S:U) scope, i.e. no system-wide compromise. The attack is delivered over a network (AV:N) but depends entirely on user interaction (UI:R) to open the malicious file, and no privileges are required (PR:N). The affected CPE inventory (cpe:2.3:a:apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos) confirms this is a shared-code defect that spans Apple's desktop, mobile, TV and headset platforms; Apple's advisories group it with a coordinated multi-OS security update, which is typical for vulnerabilities living in common frameworks, media/document parsers or system libraries reused across all four operating system families. Apple's bulletin does not publicly name the specific subsystem, so defenders should treat the exposure as 'any Apple app that ingests untrusted files' rather than a single component. The presence of the KEV-style 'Buffer Overflow' and 'Memory Corruption' tags corroborates the CWE classification but does not indicate observed exploitation.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
File delivered remotely but victim must open it (UI:R); no auth (PR:N); impact is app-only crash so C:N/I:N/A:L, matching Apple's 'unexpected app termination' statement.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted file may lead to unexpected app termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB