EUVD-2026-77992
GHSA-78p4-q47m-cx77
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker-controlled app runs on device
-
ExploitApp sends crafted input to kernel interface
-
ExecutionTrigger memory-handling flaw (CWE-119)
-
ImpactCorrupt kernel memory or terminate system
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already be able to run code as an app on the affected Apple device (iOS/iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS/visionOS/watchOS 27 and earlier). No user interaction beyond running the app and no elevated privileges are needed once the app executes, but exploitation is gated by that local app-execution foothold - it is not remotely reachable across the network despite the AV:N vector. The realistic outcome per the description is a device crash (DoS) or kernel memory corruption that would need further work to weaponize into privilege escalation. |
| Impact | The vendor CVSS of 7.5 rests on a vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) that conflicts with the description. The text 'An app may be able to cause unexpected system termination or corrupt kernel memory' describes a locally-installed app as the threat actor, which is AV:L, not the network AV:N the vector claims - this is the recurring Apple boilerplate mis-scoring pattern. The impact side is also internally inconsistent: 'unexpected system termination' is an availability impact (A:H) that the vendor scored A:N, while the kernel-memory corruption legitimately supports I:H. EPSS is low at 0.18% (7th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and no SSVC decision data was supplied. Net: this is a real kernel memory-safety bug worth patching on schedule, but it is NOT a network-remote critical issue - realistically it is a low-to-moderate priority local kernel EoP/DoS primitive requiring code execution on-device first. The AV:N/PR:N vector should be verified against Apple's advisory language before feeding it into automated prioritization. |
| Exploit ScenarioDerived | A user installs or is tricked into running a malicious or compromised app on an affected Apple device; the app issues crafted input to a vulnerable kernel-facing interface, triggering the CWE-119 memory-handling flaw. This corrupts kernel memory or crashes the device, and in a chained attack could be leveraged toward kernel-level privilege escalation. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Kernel memory corruption in Apple's operating systems (iOS/iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS, visionOS and watchOS 27 and earlier) lets an application already running on the device crash the system or corrupt kernel memory, per Apple's advisory the root cause was addressed through improved memory handling. The independent assessment rates this as a local, app-gated issue (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) rather than the vendor's network-reachable AV:N/PR:N vector of 7.5, meaning exploitation requires an attacker to first get code executing as an app on the target device; no elevated privileges or user interaction beyond launching the app are needed once that foothold exists. There is no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and no CISA KEV listing applies; the practical outcome in most cases is a device crash or denial of service, with kernel memory corruption that would require additional work to turn into privilege escalation. Vendor-released patches are available across all affected platform lines.
RemediationAI
Vendor-released patch: upgrade to iOS 26.6.1 or iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, or watchOS 27, each of which Apple documents in its advisories (https://support.apple.com/en-us/148281, https://support.apple.com/en-us/148282, https://support.apple.com/en-us/149036, https://support.apple.com/en-us/149037, https://support.apple.com/en-us/149038, https://support.apple.com/en-us/149043). Apply these updates via standard mechanisms: Settings > General > Software Update on iOS/iPadOS and watchOS, System Settings > General > Software Update on macOS and visionOS, and Settings > System > Software Update on Apple TV; fleet administrators should push the minimum OS version through MDM/DEP profiles and verify compliance, recognizing that MDM restriction of OS upgrades can itself delay patching and must be lifted for the affected builds. Because exploitation is gated on an attacker already running code as an installed app, compensating controls are the same ones that reduce app-execution footholds: enforce App Store-only or notarized app installation (removes sideloaded and enterprise-signed payloads, but blocks legitimate internal distribution), minimize enterprise-signed and developer-signed profiles (breaks internal tooling that relies on them), and keep device and app inventories audited so malicious or unwanted apps can be identified and removed. Restricting camera, microphone and other app permissions does not mitigate this defect because the trigger is memory-safety logic rather than a permission-gated API, and network-level controls such as blocking inbound connections to macOS sharing services or putting Apple devices behind host firewalls add defense in depth only against delivery of an app payload, not against the kernel bug itself. There is no configuration toggle or supported way to disable the vulnerable kernel memory-management path short of installing the fixed release, so prioritizing the OS upgrade on all six platform lines is the only complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-119, improper restriction of operations within the bounds of a memory buffer, and Apple describes the fix as improved memory handling, which is the standard wording the vendor uses for out-of-bounds or use-after-free style defects in the XNU kernel and its associated kernel extensions and drivers. Because CPE data maps the issue to a broad set of Apple platform families (ios_and_ipados, macos, tvos, visionos, watchos), the underlying defect is best understood as a shared kernel component reproduced across Apple's OS derivatives, so a single memory-safety fix propagates to every shipping branch. The vulnerable surface is the kernel memory allocator and mapping code reached by application-level requests: an app can trigger an operation whose bounds or lifetime checks are insufficient, causing either an uncontrolled termination of the system or corruption of kernel memory. The vendor's CVSS 3.1 vector claims AV:N/AC:L/PR:N/UI:N with Impact I:H and no confidentiality or availability impact, but that network-reachable, unauthenticated framing conflicts with the description, which explicitly scopes the trigger to "an app" running locally; the independent assessment corrects the vector to AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, preserving the integrity-only impact while making the local app-execution precondition explicit. Kernel memory corruption is a classic precursor to privilege escalation even though the advisory only promises integrity loss, so a future exploit chain could elevate impact beyond the documented crash.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description says 'an app may be able to', so a local unprivileged app is the actor (AV:L, PR:L); kernel corruption gives I:H and system termination gives A:H; no confidentiality impact stated.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.
Executive ViewAI
Apple endpoint and wearable platforms (iPhone, iPad, Mac, Apple TV, Vision Pro, Apple Watch) running affected OS builds carry a local kernel memory-corruption flaw that an already-running app can trigger, potentially causing device crashes or kernel memory corruption. Exploitation requires an initial malicious or compromised app on the device; no public exploit identified at time of analysis, and Patch available per vendor advisory. Leadership should care because unpatched managed devices can suffer availability disruptions, and a compromised app foothold could create a path to deeper kernel impact if chained with additional techniques.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB