EUVD-2026-77993
GHSA-jxfx-mg62-cpm8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker publishes/sideloads malicious app
-
DeliveryUser runs app locally
-
ExploitApp triggers double-free in kernel path
-
ExecutionSame allocation freed twice
-
ImpactKernel memory corrupted or system terminates
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Double free prevention
|
| Exploitation Conditions | Requires the attacker to already have local code execution via an app running on the target device (iOS/iPadOS 26.7 & 27, macOS Golden Gate 27/Sequoia 15.8/Tahoe 26.7, tvOS/visionOS/watchOS 27); the malicious app must reach and trigger the specific kernel code path affected by the double-free. Limiting factors: no network reachability (contrary to CVSS AV:N, the description implies a local app is the vector), the victim must install and run the malicious app, and reliable exploitation beyond a crash depends on kernel heap grooming that is not demonstrated. No authenticated remote service is exposed by this flaw. |
| Impact | The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) sharply overstates real-world risk for this issue, and the network vector directly conflicts with the description. Apple's own text states 'An app may be able to cause unexpected system termination or corrupt kernel memory' - that is LOCAL exploitation by an already-installed application (AV:L), not remote/network attack; the CVSS AV:N is unreliable Apple boilerplate and should be verified as local. The described impact is a kernel double-free (CWE-415) yielding a crash (A:H) or kernel memory corruption (I:H, potentially escalatable), but the description gives no basis for confidentiality/information disclosure, so C:H is also generous. Corroborating low-priority signals: EPSS is only 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit code - indicating no exploitation pressure. Net: this is a high-CVSS-but-lower-real-risk kernel bug requiring local code execution; the realistic outcome is DoS/instability, with kernel-memory-corruption-to-EoP being a plausible but unproven ceiling. Treat the vendor score with skepticism and prioritize patching on the basis of it being a kernel primitive reachable by any installed app, not the inflated 9.8. |
| Exploit ScenarioDerived | A user installs or is tricked into running a malicious or compromised app; the app issues a crafted sequence of syscalls/IPC that triggers the double-free in the affected kernel path, freeing the same allocation twice. This corrupts kernel memory, crashing the device (DoS) or, with careful heap grooming, potentially manipulating kernel state toward privilege escalation. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE-415) that can corrupt kernel memory or crash the system unexpectedly. Affected are iOS and iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS, visionOS, and watchOS before 27; the issue is fixed in those newer releases. Apple's own CVSS of 9.8 (AV:N/PR:N/UI:N) is not supported by the description, which frames the vector as a locally installed and executed app rather than a remote or unauthenticated service, and our independent assessment scores it as a local (AV:L) double-free with high availability and integrity impact but no confidentiality impact. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and EPSS is only 0.21% (11th percentile), indicating low near-term exploitation likelihood.
RemediationAI
Vendor-released patches: update to iOS 26.7 or iOS 27, iPadOS 26.7 or iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 - the corresponding Apple advisories are at support.apple.com/en-us/149034, /149035, /149036, /149037, /149038, /149041, /149042, and /149043. There is no configuration toggle that disables the vulnerable kernel routine, so patching is the only complete fix; given the local delivery vector, the most effective compensating controls are app-installation hardening while devices remain unpatched: enforce App Store-only distribution and disable sideloading/enterprise developer-signed app installs on managed iOS/iPadOS and macOS fleets (trade-off: blocks legitimate internal app deployment, so any in-house app must be re-signed through managed distribution), use MDM app allowlisting to restrict execution to vetted applications (trade-off: administrative overhead and recurring allowlist maintenance), and deploy endpoint or XDR kernel-level detections for repeated free/allocator anomalies and unexpected panics to catch a triggering attempt early (trade-off: panic telemetry may be noisy and is only detective, not preventive). All of these reduce the population of apps that can reach the vulnerable code path but do not remove the bug, so prioritize patching on all five platforms - including tvOS, visionOS, and watchOS, which are frequently overlooked in update cycles.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-415, a double free: the same region of kernel heap memory is released twice, and the second release either returns an already-freed object to the allocator or writes allocator metadata into memory that has since been reallocated. In a kernel context this corrupts heap bookkeeping and can escalate into arbitrary kernel memory corruption, use-after-free style object confusion, or an immediate panic, which matches Apple's advisory language about 'unexpected system termination or corrupt kernel memory'. The affected CPE set spans the shared Apple platform stack: cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:tvos, cpe:2.3:a:apple:visionos, and cpe:2.3:a:apple:watchos, all with wildcard version ranges, confirming the bug lives in common kernel code shipped across the entire device family rather than in a single app or service. Apple patched it by changing kernel memory-management logic (the advisory references list multiple per-platform support pages: 149034 through 149038 and 149041 through 149043). Notably, the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is internally inconsistent with the advisory text: the described trigger is a locally installed app, there is no network-reachable service, and PR:N/UI:N do not imply remote reachability here. Our independent assessment therefore uses CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, reflecting that exploitation requires the victim to install and run a malicious app that can reach and drive the specific kernel code path, and that no confidentiality loss is demonstrated.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description says a local app triggers the flaw so AV:L/PR:N/UI:N; kernel memory corruption and termination give I:H/A:H, but no disclosure is described so C:N.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.
Executive ViewAI
Apple's operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) contain a critical kernel memory corruption vulnerability that can be triggered by a locally installed app, leading to system crashes and potential data integrity issues. No public exploit identified at time of analysis, but vendor patches are available, so organizations should prioritize updating their Apple device fleets to prevent disruption. Leadership should care because unpatched devices pose a risk to business continuity and data integrity across the enterprise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB