EUVD-2026-78026
GHSA-gg5c-7rg6-2qfq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed NTLM message
-
ExploitApp processes NTLM input locally
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactUnexpected app termination (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that a local app on the affected device processes maliciously crafted NTLM authentication input, which triggers the out-of-bounds write. Per Apple's vector this is a local attack (AV:L) with no privileges (PR:N) and no user interaction (UI:N) beyond the app receiving/parsing the malicious NTLM data. Exploitation is LIMITED to denial of service (unexpected app termination) with no confidentiality or integrity impact, and is constrained to unpatched versions (before iOS/iPadOS 27 and macOS Golden Gate 27); the exact vulnerable app/service handling NTLM is not specified in the advisory. |
| Impact | Real-world risk is LOW-to-MODERATE and consistent across signals. The Apple-supplied CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 6.2 but the impact is availability-only - an out-of-bounds write (CWE-787) that leads to unexpected app termination, i.e. a crash/DoS, not code execution or data disclosure. EPSS is very low at 0.16% (5th percentile), there is no CISA KEV listing and no public exploit identified, so this is 'no public exploit identified at time of analysis.' The one point of tension: the description says 'processing maliciously crafted NTLM input,' and NTLM is a network authentication protocol, which superficially suggests a network delivery path, yet Apple rated it AV:L (local) - this likely reflects that a local app must process the malformed NTLM data, so the local vector is Apple's authoritative call and should be trusted over the protocol name. The 'Buffer Overflow'/'Memory Corruption' tags overstate impact only insofar as the write does not translate to code execution here; the outcome is termination. Net: a genuine but low-priority DoS bug, patched, with no exploitation pressure. |
| Exploit ScenarioDerived | A malicious or malformed NTLM message is fed to a vulnerable app/service on the target device, triggering an out-of-bounds write in the NTLM parsing path and crashing the process. The impact is limited to unexpected app termination (denial of service); no code execution, data theft, or privilege gain results. No public proof-of-concept or active exploitation has been reported. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
An out-of-bounds write in Apple's NTLM handling can terminate affected applications on iOS, iPadOS and macOS when they process maliciously crafted NTLM authentication input, yielding a denial-of-service primitive with no confidentiality or integrity impact. Per Apple's CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.2) exploitation is local, requires no privileges and no user interaction beyond the target app parsing the crafted NTLM data, and is constrained to versions before iOS 27, iPadOS 27 and macOS Golden Gate 27. Real-world risk is LOW-to-MODERATE and consistent across signals: EPSS is 0.16% (5th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified at time of analysis, though Apple has released patched versions.
RemediationAI
Vendor-released patch: Apple fixed this in iOS 27, iPadOS 27 and macOS Golden Gate 27, so the primary action is to upgrade affected devices to those versions or later using the guidance in https://support.apple.com/en-us/149034 and https://support.apple.com/en-us/149035. Because the impact is limited to unexpected application termination, this can be scheduled in a normal patch cycle rather than treated as an emergency, particularly given the 0.16% EPSS score and the absence of KEV listing or public exploit code. If immediate upgrade is not possible, reduce the attack surface by preventing the affected apps and services from processing NTLM input from untrusted sources - for example avoid initiating SMB or proxy-authenticated connections to untrusted hosts and restrict enterprise NTLM authentication to trusted internal peers; the trade-off is degraded connectivity or single-sign-on behaviour with external systems that require NTLM. There is no evidence of a configuration flag that disables only the vulnerable parser, so these are compensating controls rather than a fix, and they should be paired with monitoring for repeated unexpected application terminations on unpatched hosts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a classic CWE-787 out-of-bounds write in the code path that parses NTLM authentication messages; insufficient validation of attacker-controlled length or field data lets a write occur past the end of an allocated buffer, corrupting memory and most often causing the hosting process to abort. NTLM is a challenge/response authentication protocol still widely supported by Apple's networking and authentication stacks (for example SMB, HTTP authentication and enterprise single-sign-on paths), so any local application that accepts and parses an NTLM exchange supplied by an untrusted peer is a potential trigger. Apple addressed the issue with improved bounds checking, and the advisory does not name the specific framework, daemon or app that contains the vulnerable parser, so the exposed surface should be treated as any Apple component that ingests NTLM input rather than a single binary. The CPE data (cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos) confirms the fix spans the iOS/iPadOS and macOS product lines. Because the assessed impact is availability-only (C:N/I:N/A:H) with local attack vector and no privileges required, the flaw is best characterized as a local denial-of-service bug in an authentication parsing path, not a memory-corruption primitive with demonstrated code-execution potential.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Adopting Apple's local vector: a local app must process the malformed NTLM input (AV:L), no privileges or interaction needed, and the sole impact is app termination (A:H, C/I:N).
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. Processing maliciously crafted NTLM input may lead to unexpected app termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB