EUVD-2026-77918
GHSA-j7g7-8fc9-x6qg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious disk image
-
DeliveryDeliver DMG to victim
-
ExploitVictim mounts disk image
-
ExecutionTrigger buffer overflow in kernel parser
-
ImpactCorrupt kernel memory / terminate system
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively mount a maliciously crafted disk image (e.g., a .dmg) on an affected macOS version below Golden Gate 27 / Sequoia 15.8 / Tahoe 26.7. The key limiting factor is mandatory user interaction (UI:R): the attacker must deliver the image and the user must choose to mount it - there is no autonomous remote trigger against a listening service. No authentication or elevated privileges are needed (PR:N), and no special product configuration is required beyond default macOS disk-image handling. |
| Impact | This is a genuine but not urgent priority. The vendor CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates it High, but the network attack vector is questionable: exploitation requires the victim to obtain AND actively mount a maliciously crafted disk image, which is a local file-parsing operation in the kernel rather than a remotely-reachable service. The AV:N/UI:R combination is Apple's typical scoring for delivered-file bugs, but the real-world constraint is user-driven mounting, so this behaves more like a local (AV:L) UI:R issue - verify vector interpretation before treating as remotely exploitable. Corroborating the lower urgency: EPSS is only 0.21% (12th percentile), there is no CISA KEV listing (no confirmed active exploitation), and no public exploit code identified. The C:H/I:H impacts are the plausible ceiling for kernel memory corruption but the described primary effect is unexpected system termination (A:H / DoS); full confidentiality/integrity compromise would require successful, controlled kernel exploitation, which is non-trivial. Net: patch on normal cadence for a client-OS memory-corruption bug, but no signal of imminent mass exploitation. |
| Exploit ScenarioDerived | An attacker distributes a malicious .dmg disk image (via download, email attachment, or a shared drive) and social-engineers a macOS user into mounting it. When the OS parses the crafted image, a buffer overflow corrupts kernel memory, crashing the system or potentially enabling kernel-level compromise. No public exploit code has been identified, and exploitation depends on the victim taking the mount action (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Kernel memory corruption in Apple macOS disk image handling allows an attacker to crash the system or corrupt kernel memory when a user mounts a maliciously crafted disk image; affected versions are all macOS releases before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. Exploitation requires the victim to actively mount the image (UI:R) with no authentication needed (PR:N), and no public exploit code has been identified at time of analysis. Apple has released fixes, and EPSS is low (0.21%, 12th percentile), making this a genuine but not urgent patch priority.
RemediationAI
Vendor-released patch: macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27 (Apple advisories: https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149042, https://support.apple.com/en-us/149043). Until patching is possible, avoid mounting disk images from untrusted or unverified sources; this is the most effective compensating control but requires user discipline and may be impractical for workflows that depend on external DMGs. For higher-assurance environments, mount suspicious images only inside a disposable virtual machine with a non-persistent disk, or use system policy (e.g., Gatekeeper/MDM restrictions) to block unsigned or unvetted images - noting that such policies can break legitimate software distribution. No vendor workaround short of patching is documented.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a classic buffer overflow (CWE-120) in the macOS kernel's disk image parsing subsystem, where insufficient bounds checking on crafted structures inside a .dmg or similar image leads to out-of-bounds writes and kernel memory corruption. The CPE cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* combined with EUVD version ranges confirms all macOS installations below the fixed releases are affected. While the NVD-style vector is AV:N, our independent assessment places it at AV:L (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), correctly reflecting that the attacker must deliver a file that the victim mounts locally; there is no remotely reachable service involved. Mounting triggers the vulnerable code path during image validation, so the user interaction is the primary barrier.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Mounting a local disk image is a local file-parse operation so AV:L (not vendor AV:N); no privileges but user must mount the file (PR:N/UI:R); kernel corruption yields C/I/A:H.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.
Executive ViewAI
Apple macOS endpoints are affected by a high-severity kernel memory corruption issue in disk image handling that can crash or corrupt the kernel if a user mounts a maliciously crafted image; exploitation is unauthenticated but requires user interaction, and no public exploit identified at time of analysis. Organizations with Macs below Sequoia 15.8, Tahoe 26.7, or Golden Gate 27 face avoidable availability and integrity risk, although Apple has released fixes. Leadership should prioritize routine patch deployment across the macOS fleet rather than emergency response.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Exploit-DB