EUVD-2026-77929
GHSA-4f6f-fx5w-6xfj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or run malicious app locally
-
DeliverySupply crafted oversized input value
-
ExploitTrigger integer overflow (CWE-190)
-
ExecutionBypass insufficient input validation
-
ImpactCause unexpected system termination (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access via a malicious or compromised application already installed and executing on the target device (AV:L, PR:L per CVSS) - there is no remote or network-triggerable path. The app must be able to reach the vulnerable code and supply input that triggers the CWE-190 integer overflow. Limiting factors: the attacker must first get code running on the device (App Store review, sideloading, or an already-compromised app), impact is confined to denial of service (forced system termination, A:H) with no confidentiality or integrity loss, and patched OS versions (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, Tahoe 26.7, Golden Gate 27) fully remediate it. No user interaction beyond running the app (UI:N). |
| Impact | This is a genuinely low-priority issue despite its MEDIUM 5.5 CVSS rating. Every risk signal points to limited impact: the CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - local attack vector, requiring an already-installed and running app (PR:L), with availability-only impact (A:H) and no confidentiality or integrity loss. The impact is a denial of service ('unexpected system termination'), not code execution or data theft - the CWE-190 integer overflow leads to a crash, not memory-corruption RCE. EPSS is very low at 0.20% (10th percentile), it is NOT in CISA KEV, and no public exploit code is identified. There are no conflicting signals here: CVSS local vector aligns with the description ('an app may be able to...'), and the low EPSS/absence of KEV is consistent with an availability-only, locally-scoped bug that offers little attacker value. The only amplifying factor is prevalence - this affects Apple's ubiquitous consumer OSes - but the low technical impact keeps real-world risk modest. Apply the vendor patch during normal cycles; this does not warrant emergency response. |
| Exploit ScenarioDerived | A malicious or compromised app installed on an iPhone, iPad, or Mac feeds crafted input that triggers an integer overflow in the affected system component, causing the input-validation flaw to be hit and terminating the system (kernel panic / forced reboot or process crash). Because the app must already be running locally (PR:L, AV:L), this is a local nuisance/DoS rather than a remote compromise. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Denial of service in Apple iOS, iPadOS, and macOS results from an integer overflow (CWE-190) that a locally installed and executing application can trigger to cause unexpected system termination. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5) confirms local access with low privileges, no user interaction, and impact limited to availability - there is no confidentiality or integrity loss and no remote or network-triggerable path. This is a genuinely low-priority issue despite its MEDIUM rating: EPSS is 0.20% (10th percentile), no public exploit code was identified at time of analysis, there is no CISA KEV listing, and Apple has shipped fixed versions (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27), leaving exposure limited to unpatched devices on which an attacker can already run code.
RemediationAI
Vendor-released patch: upgrade to iOS 26.7 or iOS 27 (with matching iPadOS 26.7/27), macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 as applicable - Apple's fix is an input-validation correction, so only the patched builds fully remediate CVE-2026-65408; see the advisories at https://support.apple.com/en-us/149034, https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149041, https://support.apple.com/en-us/149042, and https://support.apple.com/en-us/149043 for the per-platform mapping. Because the vector is AV:L/PR:L/UI:N, there is no port, endpoint, or network filter that mitigates it, and no vendor workaround is published; the practical compensating controls are administrative - enforce MDM app allowlisting and block sideloaded or unvetted application sources so a hostile app cannot reach the vulnerable code path (trade-off: reduced flexibility for users and line-of-business software), and prioritize patching managed fleets where untrusted third-party or sideloaded apps are permitted, accepting that such restrictions do not stop a compromise that already delivers code execution. Monitor device crash and termination reports as a detection signal for attempted triggering until every affected iOS/iPadOS and macOS build is updated, and note that devices left on unsupported macOS versions below Sequoia 15.8 will not receive a fix and must be migrated or retired.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-190, an integer overflow/ wraparound that Apple addressed with improved input validation in the affected operating system components. When a locally executing application supplies crafted input that is not adequately bounds-checked, an arithmetic operation on a length, size, or index value can wrap, producing an undersized allocation or an out-of-range reference that corrupts memory or drives the system into an unrecoverable state (A:H, forced termination). Because the flaw is reachable only from application context, it lives inside the platform's app-facing attack surface rather than a network service; the CPE entries cpe:2.3:a:apple:ios_and_ipados:* and cpe:2.3:a:apple:macos:* confirm that iOS/iPadOS and macOS share the affected code path across their respective release trains. The ENISA EUVD record (EUVD-2026-77929) and tags (Integer Overflow, Buffer Overflow, Apple, iOS and iPadOS) align with the NVD entry and the five Apple support advisories, all of which describe the same input-validation fix rather than a remote, wormable, or privilege-escalation primitive.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local malicious app required (AV:L, PR:L); low complexity; availability-only crash with no data confidentiality/integrity impact (C:N/I:N/A:H), matching Apple's vector.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB