EUVD-2026-77987
GHSA-4v5m-fgg9-qf7f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted file to target
-
ExploitVictim opens file in vulnerable app
-
ExecutionTrigger memory corruption during parsing
-
ImpactApplication terminates unexpectedly (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security Clickjacking prevention, X-Frame-Options
|
| Exploitation Conditions | Exploitation requires the victim to open a maliciously crafted file on an affected Apple OS (iOS/iPadOS before 27, or macOS Golden Gate 27); the flaw is in file processing, so the malicious content must reach and be parsed by the vulnerable application. Limiting factors per the CVSS vector: the attack vector is LOCAL (AV:L) - the file must be delivered to and opened on the device - and user interaction is REQUIRED (UI:R), so there is no fully remote or unattended exploitation. No special privileges are needed (PR:N). The realistic outcome is application termination (DoS); code execution is not claimed by the vendor. |
| Impact | Real-world risk is LOW-to-MODERATE despite the vendor's 7.8 'High' rating. The CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - a LOCAL attack vector requiring user interaction (opening a maliciously crafted file), not remote exploitation. All exploitation signals point away from urgency: EPSS is 0.19% (8th percentile), there is no CISA KEV listing, and no public POC is identified. Crucially, the description only supports 'unexpected app termination' (a crash/DoS), yet the vendor scored C:H/I:H/A:H - this is a conflict: the stated impact is availability-only, so the C:H and I:H claims are not substantiated by the description and appear inflated (independent read is C:N/I:N/A:H, roughly 4.3). Memory-corruption bugs can sometimes be escalated beyond a crash, but Apple's advisory language ('may lead to unexpected app termination') does not claim code execution, so treat confidentiality/integrity impact as unverified. Additional data-quality problems compound the picture: CWE-1021 (Improper Restriction of Rendered UI Layers / clickjacking) does not match a memory-corruption file-parsing bug - CWE-787/CWE-119 would be correct. Net: routine patch-cycle priority, not an emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious file (delivered via email, message, web download, or AirDrop) and induces a victim to open it on an iOS/iPadOS/macOS device. When the vulnerable parser processes the file, memory corruption triggers and the handling application terminates unexpectedly (denial of service). No public exploit code is identified, and the vendor does not claim code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Memory corruption during file parsing on Apple iOS/iPadOS (before version 27) and macOS (before Golden Gate 27) can cause the handling application to terminate unexpectedly when a user opens a maliciously crafted file; the flaw was addressed by strengthening input validation. Because the attack vector is local (the file must be delivered to and opened on the device) and user interaction is required, exploitation is not remote or unattended, and no special privileges are needed (PR:N, unauthenticated). The vendor rates this 7.8 High, but the independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects availability-only impact, and combined with a very low EPSS of 0.19% (8th percentile) and no public exploit identified at time of analysis, real-world risk is LOW-to-MODERATE rather than critical.
RemediationAI
Vendor-released patch: update to iOS 27, iPadOS 27, or macOS Golden Gate 27, which contain the improved input-validation fix; refer to the Apple advisories at https://support.apple.com/en-us/149034 (iOS/iPadOS) and https://support.apple.com/en-us/149035 (macOS). Because the attack requires the victim to open a crafted file, compensating controls include enforcing a policy of not opening files from untrusted or unsolicited sources and routing untrusted documents through a sandboxed or disposable viewer/VM, while recognizing that this reduces convenience and does not fully eliminate exposure on the host OS. On managed fleets, prioritize patching endpoints that routinely handle external files (mail, messaging, download folders) and monitor for repeated application crashes, which may indicate attempted exploitation. Note that mitigation via application-level sandboxing carries the trade-off of limited file-format support and does not address the underlying OS parsing defect, so upgrading to version 27 remains the definitive remedy.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a memory corruption condition that arises when a malformed file is parsed, and Apple resolved it through improved input validation in iOS 27, iPadOS 27, and macOS Golden Gate 27. CPE data (cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos) confirms the affected surface spans Apple's mobile and desktop operating systems, with all versions below 27 in scope per EUVD. The input-validation root cause class is consistent with the description of a crafted file corrupting memory during processing; however, the assigned CWE-1021 (Improper Restriction of Rendered UI Layers or Frames, i.e., clickjacking) does not align with a memory-corruption/parsing defect and should be treated as a likely classification error rather than a reliable indicator of the underlying weakness. Similarly, the attached tags (XSS, Buffer Overflow) appear to be auto-generated and partly inconsistent with the advisory text, so they should not be used to broaden the impact assessment. The critical technical constraint is that the vulnerable parsing routine must actually receive and process the malicious content, which keeps the realistic outcome at application termination (denial of service) rather than code execution, matching the independent CVSS availability-only scoring.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local crafted-file open with required user interaction; description supports only app termination, so C:N/I:N and A:H rather than the vendor's C:H/I:H.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. Processing a maliciously crafted file may lead to unexpected app termination.
Executive ViewAI
Apple's iOS/iPadOS and macOS platforms carry a high-severity availability risk for end users who open untrusted files on unpatched devices. The issue is not remotely exploitable and requires local file delivery plus user action, and no public exploit identified at time of analysis limits broad organizational exposure. Leadership should direct IT to confirm which managed iPhones, iPads, and Macs remain below iOS/iPadOS 27 or macOS Golden Gate 27 and close that gap quickly to prevent targeted disruptions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB