EUVD-2026-78007
GHSA-749f-cxrr-qp4r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted file to victim
-
DeliveryVictim opens malicious file
-
ExploitOverflow parser with bad size field
-
ExecutionTrigger buffer overflow
-
ImpactProcess terminates unexpectedly
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open a maliciously crafted file on an affected, unpatched Apple OS (iOS/iPadOS before 26.7 or 27, macOS Sequoia before 15.8 / Tahoe before 26.7 / Golden Gate before 27, tvOS before 27, visionOS before 27). This is a local vector (AV:L) gated by user interaction (UI:R) - there is no remote or unauthenticated network trigger; the attacker cannot invoke it without the user opening the attacker-supplied file. The specific file format and parsing component are not named in Apple's advisory, and the demonstrated outcome is process termination rather than confirmed code execution, which limits realistic impact to denial of service absent further exploitation research. |
| Impact | The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8) rates confidentiality, integrity, and availability as High, but the description only substantiates availability impact: 'Opening a maliciously crafted file may lead to unexpected process termination.' That is a denial-of-service outcome, not code execution or data disclosure, so the C:H/I:H rating is not supported by the published text - Apple's advisories often score memory-safety bugs conservatively as full-impact even when only a crash is demonstrated. Attack vector is correctly Local with required user interaction (UI:R): the victim must open the malicious file. EPSS is low at 0.22% (13th percentile), consistent with a UI-gated, local-only file-parsing bug rather than a mass-exploitable remote flaw. There is no CISA KEV listing and no public exploit code referenced, so exploitation status is 'no public exploit identified at time of analysis.' Net: this is a moderate-priority patch - genuinely useful to remediate given Apple's ubiquity, but not an emergency. Note the conflict: vendor scores C:H/I:H yet the only described impact is process termination (availability) - verify whether memory corruption is actually exploitable beyond a crash before treating this as an RCE. |
| Exploit ScenarioDerived | An attacker crafts a malformed file (e.g., a document, image, or media file processed by an affected Apple OS parser) and delivers it to a victim via email, messaging, or a web download. When the victim opens the file, improper size validation triggers a buffer overflow (CWE-120) that terminates the processing application. No public exploit code has been identified; observed impact is unexpected process termination (denial of service). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Opening a maliciously crafted file on an unpatched Apple device can crash the component that parses it, because a buffer overflow in Apple's size-validation logic was only corrected in the latest OS releases. Affected platforms are iOS/iPadOS before 26.7 (and before 27), macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, tvOS before 27, and visionOS before 27; exploitation is local and requires the victim to actively open the attacker-supplied file, with no remote or network trigger available. The demonstrated outcome per Apple's advisory is unexpected process termination (denial of service) rather than code execution or data disclosure, and no public exploit code or confirmed active exploitation was identified at time of analysis, with EPSS at 0.22% (13th percentile).
RemediationAI
Vendor-released patch: update to iOS 26.7 or iOS 27 (iPadOS 26.7 or 27), macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, or visionOS 27 as applicable - Apple states the issue is addressed through improved size validation in these releases, so the corresponding Apple support advisories (https://support.apple.com/en-us/149034, 149035, 149036, 149038, 149041, 149042, 149043) should be used to confirm the build matching each device. Because patch rollout on Apple platforms depends on user-initiated updates and managed-device MDM deferral policies, prioritize enforcement on devices that routinely handle untrusted files (mail attachments, downloads, removable media, shared cloud folders) and where an MDM enrollment allows a minimum-OS compliance rule; note that such rules may break compatibility with apps pinned to older OS builds. Until patching is complete, the practical compensating control is to prevent the crafted file from being opened: block or quarantine untrusted attachment types at the mail/web gateway and in endpoint protection, instruct users not to open unexpected documents or media received from unverified senders, and, where feasible, process untrusted files in a sandboxed or isolated account rather than on a primary device - the trade-off is reduced workflow convenience and possible false positives on legitimate attachments. Since exploitation requires local user interaction and the demonstrated result is process termination, defenders should treat this as an availability risk rather than confirmed code execution; no indications of active exploitation or public exploit code were identified, so emergency out-of-band response is not warranted for most environments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-120, a classic buffer overflow (unbounded copy into a fixed-size buffer) in a file-parsing code path that Apple remediated through improved size validation - the flaw class is memory corruption arising from missing or insufficient bounds checks on attacker-controlled length or size fields. The CPE inventory covers Apple's client operating system families: apple:ios_and_ipados, apple:macos, apple:tvos and apple:visionos, indicating the vulnerable code is shared across Apple's platform stack rather than confined to a single OS, consistent with a common media/document parsing or system framework. Note the scoring divergence: Apple/NVD publish CVSS:3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8), whereas the independent assessment reduces impact to CVSS:3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, because the advisory text substantiates only availability impact ('unexpected process termination'). The C:H/I:H components are best treated as conservative pre-emptive scoring of a memory-safety bug whose exploitability beyond a crash has not been publicly demonstrated. The vector is local (AV:L), unauthenticated in the PR:N sense, and gated by user interaction (UI:R) - the attacker cannot trigger it without the user opening the crafted file, and neither the specific file format nor the parsing component is named in the available advisory text. ENISA's EUVD entry (EUVD-2026-78007) mirrors the Apple version ranges.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file open with user interaction (AV:L/UI:R); description substantiates only process termination, so A:H with C:N/I:N - no evidence of disclosure or code execution.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Opening a maliciously crafted file may lead to unexpected process termination.
Executive ViewAI
Apple has released fixes for a high-severity buffer overflow in its file-parsing logic that affects unpatched iPhones, iPads, Macs, Apple TVs, and Vision Pro devices. The flaw can cause the affected process to terminate when a user opens a malicious file, creating localized denial-of-service disruptions rather than remote compromise or data loss. The exploitation status is no public exploit identified at time of analysis, so the primary organizational risk is unpatched Apple fleets experiencing avoidable availability incidents and helpdesk escalation, making inventory and patch compliance the priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB