EUVD-2026-78018
GHSA-32cc-rjrq-8hxg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious image file
-
DeliveryDeliver via web/message to victim
-
ExploitVictim's app processes image
-
ExecutionOut-of-bounds write corrupts memory
-
ImpactUnexpected app termination (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to process or open a maliciously crafted image within an affected app on iOS/iPadOS (before 26.7) or macOS (before Golden Gate 27); this user interaction (UI:R) - opening or rendering the attacker-supplied image - is the primary limiting factor. No authentication or elevated privileges are needed (PR:N), and the image can be delivered remotely (AV:N), but the maximum realistic outcome is an app crash (A:H only), so there is no privilege gain or data exposure. Exploitation is bounded to unpatched Apple OS versions. |
| Impact | All impact signals point to a low-priority, availability-only issue despite the moderate 6.5 CVSS. The vendor vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H is confidentiality/integrity-clean and rates only A:H, meaning the sole consequence is 'unexpected app termination' - a crash/DoS, not code execution or data disclosure, consistent with CWE-787 out-of-bounds write that Apple fixed via improved bounds checking. Exploitation signals are weak and mutually consistent: EPSS is 0.15% (5th percentile), there is no CISA KEV listing, and no public exploit code is identified - so this is no public exploit identified at time of analysis and not active exploitation. AV:N with UI:R is realistic (a malicious image can be delivered remotely, e.g. via web/message, but a user must open or process it), yet the ceiling is a terminated app rather than a compromised device. The Buffer Overflow / Memory Corruption tags describe the OOB-write class accurately but could overstate risk if read as arbitrary code execution; the assessed impact remains a crash. Net: real but low urgency - patch on normal cadence rather than emergency. |
| Exploit ScenarioDerived | An attacker crafts a malformed image and delivers it via a webpage, email, or messaging app; when the victim's iOS/iPadOS or macOS app processes or renders the image, an out-of-bounds write corrupts memory and the app terminates unexpectedly. Impact is limited to a denial of service (app crash) with no evidence of data disclosure or code execution. No public proof-of-concept or active exploitation has been identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
An out-of-bounds write in Apple's image handling code can terminate an application on iOS and iPadOS before 26.7 and on macOS before Golden Gate 27 when a user opens a maliciously crafted image. The attacker needs no credentials or privileges, but the victim must actively render the attacker-supplied image, and the maximum assessed impact is availability only (app crash) with no code execution, privilege gain, or data exposure. Exploitation is not confirmed in the wild (no CISA KEV listing), EPSS is 0.15% (5th percentile), and no public exploit code has been identified; Apple has shipped fixes in iOS 26.7, iPadOS 26.7, and macOS Golden Gate 27.
RemediationAI
Vendor-released patch: iOS 26.7, iPadOS 26.7, and macOS Golden Gate 27 - install these exact versions via Settings > General > Software Update on iOS/iPadOS or System Settings > General > Software Update on macOS, and consult Apple's advisories at https://support.apple.com/en-us/149035 and https://support.apple.com/en-us/149041 for the per-platform notes. Because exploitation requires a user to open a crafted image, the strongest interim control is to treat image files from untrusted sources as executable content: block or quarantine image attachments at the mail and web gateway, and disable automatic image preview/thumbnail generation in chat, mail, and messaging clients (trade-off: users lose inline previews and must open attachments manually, which adds friction and may simply shift the risky open action later). Until patched builds can be deployed, restrict untrusted file shares and downloads to managed devices only, and consider disabling the ability of low-trust apps to open images from shared or external locations (trade-off: reduces workflow flexibility and may break legitimate document review). Note that filtering by file extension is weak mitigation here, since image formats are trivially re-wrapped, so content-based inspection or format allow-listing at the perimeter is preferred, and none of these workarounds should delay applying the fixed OS versions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787, an out-of-bounds write, which Apple addressed by improving bounds checking in its image parsing routines that run when the operating system decodes or renders an image supplied by an application or a file share. CPE data confirms the affected code ships inside the operating system itself rather than a standalone app: cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:* and cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, meaning the vulnerable parser is reached through any app on those platforms that displays user-supplied images. Because decoding occurs before the calling app can validate content, a crafted file can drive the parser to write past the end of an allocated buffer, corrupting memory. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) and the independent assessment both scope the realized effect to a crash of the processing app, not to attacker-controlled code execution, so the practical consequence is denial of service to the affected app rather than a full system compromise; the buffer-overflow and memory-corruption tags in the intelligence feed describe the defect class, not a demonstrated exploit outcome.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Malicious image is remotely deliverable (AV:N) but requires the user to open/process it (UI:R); impact is limited to app termination, so C:N/I:N/A:H.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Golden Gate 27. Processing a maliciously crafted image may lead to unexpected app termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB