EUVD-2026-77985
GHSA-7gqq-cj2j-mwv7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious video file
-
DeliveryDeliver to victim (message/web/AirDrop)
-
ExploitVictim opens/previews file
-
ExecutionOOB write corrupts memory in media parser
-
ImpactUnexpected app termination
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to process an attacker-crafted video file within a vulnerable media-handling app on an unpatched Apple OS (iOS/iPadOS before 26.7/27, macOS before Golden Gate 27 / Sequoia 15.8 / Tahoe 26.7, tvOS/visionOS before 27). Limiting factors: the vector is local (AV:L) and requires user interaction (UI:R) - the user must open or preview the malicious file; there is no remote, zero-click, or unauthenticated network path in the described behavior. The realistic outcome is app termination, so impact is bounded by the crash unless the OOB write can be further leveraged, which the vendor advisory does not describe. |
| Impact | Vendor CVSS 3.1 base is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but the signals point to a materially lower real-world priority. The description states only that processing a malicious video file 'may lead to unexpected app termination' - that supports an availability (crash) impact, not the C:H/I:H confidentiality/integrity impact the vendor claims; the C:H/I:H appears aspirational given an OOB write is an RCE-capable primitive, but no code execution or data disclosure is described. EPSS is low at 0.18% (7th percentile), there is no CISA KEV listing and no public POC identified, so exploitation status is 'no public exploit identified at time of analysis.' The vector is local with required user interaction (AV:L/UI:R), meaning a victim must open/process attacker-supplied media - this is not a remote wormable issue. Net: a genuinely patch-worthy memory-corruption bug on ubiquitous Apple platforms, but the aggregate signals (low EPSS, no KEV/POC, local+UI-gated, crash-only outcome) place it as routine-priority rather than emergency. Conflict to verify: vendor scores full C:H/I:H/A:H while the description supports only app termination (A:H) - treat higher-impact claims as unconfirmed pending vendor detail. |
| Exploit ScenarioDerived | An attacker crafts a malicious video file and delivers it via message, email, web page, or AirDrop; when the victim opens or previews it, the OOB write corrupts memory in the media-parsing code and crashes the app. No public exploit code is available, and exploitation requires the user to actually process the crafted file, limiting it to a targeted social-engineering delivery. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
An out-of-bounds write in Apple's media-handling code can corrupt memory and terminate the affected app when a user opens or previews a maliciously crafted video file on an unpatched Apple OS. The flaw affects iOS/iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS before 27 and visionOS before 27, and Apple resolved it with improved bounds checking in those releases. Exploitation requires local delivery of the crafted file plus user interaction (CVSS AV:L/UI:R/PR:N), no public exploit code has been identified at time of analysis, and EPSS is low at 0.18% (7th percentile), so the practical risk is bounded by the demonstrated outcome of app termination rather than confirmed remote or zero-click compromise.
RemediationAI
Vendor-released patches address this issue: upgrade to iOS 26.7 or iOS 27 (and the matching iPadOS 26.7/27), macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27, tvOS 27, and visionOS 27, applying the fixes documented in the Apple support advisories (support.apple.com/en-us/149034, 149035, 149036, 149038, 149041, 149042, 149043). Patch status is 'available from vendor' with no version ambiguity, so there is no need to rely on compensating controls once devices are updated; prioritize the update on endpoints that routinely handle untrusted media (shared workstations, media review stations, kiosks) where a crafted video is most likely to be opened. Until every device is patched, the only meaningful mitigations reduce the chance a crafted video reaches a user: block or quarantine untrusted video attachments at the mail/web gateway, disable auto-preview/thumbnail generation for untrusted sources where the platform allows it, and instruct users not to open video files from unknown senders - with the trade-off that these controls are user-dependent and easily bypassed, and they do not eliminate the underlying out-of-bounds write. Because the vector is local and requires user interaction (UI:R), restricting which apps may open untrusted media and enforcing MDM-managed update deadlines materially shrinks exposure; there is no remote network control, port, or authentication setting that can be disabled to remove this bug.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-787 (out-of-bounds write), an improper bounds-checking failure in the code path that parses and decodes video files on Apple platforms. The affected component is the shared Apple media/video parsing stack, evidenced by the identical fix landing across the full OS family as reflected in the CPE set: cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:tvos, and cpe:2.3:a:apple:visionos, all with version ranges ending before the respective patched releases. Writing past the end of an allocated buffer during media parsing can corrupt adjacent heap memory; because the parsing code runs inside the app that opens the file (or a system media component handling it), the immediate observable effect per the vendor advisory is unexpected app termination. The vendor scores the issue CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while our independent assessment narrows the impact to availability only (C:N/I:N/A:H) on the same local, user-interaction-required vector, since the described behavior demonstrates a crash rather than confirmed code execution, data disclosure, or file modification. The local vector means an attacker must first get the crafted video onto the device - via download, message attachment, shared file, or removable/cloud-synced media - and then persuade the user to open or preview it; there is no network-reachable, unauthenticated, or zero-click path in the documented behavior. The issue was reported by Apple and coordinated through the vendor's consolidated security advisories.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file must be opened by the user (AV:L/UI:R, PR:N since any user can be tricked); description supports only app termination, so A:H with C:N/I:N absent evidence of code execution or disclosure.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted video file may lead to unexpected app termination.
Executive ViewAI
Apple’s media-handling components across iOS/iPadOS, macOS, tvOS, and visionOS can be crashed by a crafted video file, causing disruption for end users on unpatched devices. The flaw is unauthenticated but requires local file delivery and user interaction; no public exploit identified at time of analysis, and vendor patches are available, so the immediate business risk is localized availability loss rather than remote compromise. Leadership should care because Apple devices are widely used, and unpatched fleets risk user productivity interruptions and potential follow-on memory-corruption effects if exploitation techniques evolve.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB