EUVD-2026-78032
GHSA-p7c2-qmvr-mg76
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain root on Apple device
-
ExploitRun malicious app as root
-
ExecutionTrigger uninitialized kernel buffer path
-
ImpactRead leaked kernel memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | Exploitation requires local code execution as root on the target Apple OS (iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, tvOS 27, visionOS 27, watchOS 27). The attacker must already possess root privileges and run an app that reaches the affected kernel code path; there is no remote, network, or user-interaction vector. The root prerequisite is the dominant limiting factor - the flaw yields only uninitialized kernel memory to a process that already holds the highest local privilege, so it is a post-compromise information leak rather than an initial-access or privilege-escalation primitive. Note the vendor's PR:N metric contradicts this stated root requirement. |
| Impact | This is a genuinely low real-world priority despite the 6.2 (Medium) CVSS. The signals align on low urgency: EPSS is 0.17% (7th percentile), there is no CISA KEV listing, and no public exploit code has been identified. The single most important limiting factor is buried in the description: exploitation requires 'an app with root privileges.' A CWE-908 uninitialized-memory read only ever leaks kernel data to a process that has ALREADY achieved root - meaning the attacker already holds the highest local privilege before the flaw yields anything. IMPORTANT DATA CONFLICT: the vendor CVSS vector encodes PR:N (no privileges required), which directly contradicts the description's explicit 'root privileges' precondition. This is almost certainly a scoring error - the correct value is PR:H, which lowers the base score to roughly 4.4. Treat the vendor's PR:N as unreliable. The impact is confidentiality-only (C:H, I:N, A:N): a small window of uninitialized kernel memory that may contain residual sensitive data. Overall this is a defense-in-depth / attack-surface-reduction fix, not an emergency patch. |
| Exploit ScenarioDerived | An attacker who has already gained root on an Apple device (via a separate exploit or a rooted/managed device) runs a malicious app that invokes the affected kernel path and reads back a buffer that was never fully initialized, harvesting residual kernel memory contents (potentially pointers or secrets useful for further exploitation). No public exploit code exists and the local-only, root-gated nature makes opportunistic use unlikely. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Uninitialized kernel memory disclosure in Apple's operating system family allows a local app that already holds root privileges to read residual data left in kernel memory buffers, an information-leak primitive that exposes potentially sensitive kernel memory contents. The flaw is fixed across iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, so affected users should update promptly. No public exploit code has been identified at time of analysis, and EPSS places the probability of exploitation at roughly 0.17% (7th percentile), consistent with the assessment that the mandatory root prerequisite - the attacker must already be running code at the highest local privilege level - makes this a post-compromise leak rather than an initial-access or privilege-escalation primitive, and a genuinely low real-world priority despite the 6.2 Medium base score.
RemediationAI
Vendor-released patch: iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 - update every affected device to the matching release and prioritise macOS/iOS endpoints where root-capable code commonly runs. Apply the fixes via normal software update or MDM-deployed update enforcement, referencing the Apple advisories at https://support.apple.com/en-us/149034 through https://support.apple.com/en-us/149043 for per-platform version mapping. Because exploitation requires root, meaningful compensating controls are limited and are about reducing the population of root-capable code rather than blocking the flaw itself: remove or tightly restrict unnecessary apps and services that run as root or are installed with elevated entitlements, keep System Integrity Protection and hardened runtime enabled, and enforce least privilege plus supervised/notarized-only app policy on managed fleets - each reduces the exposure window but does not eliminate the leak and constrains legitimate administrative workflows. Monitor for processes performing anomalous kernel memory reads or repeated reads of kernel address ranges as a detection mitigation, accepting that this is detective rather than preventive. No network-level control applies, since the vector is strictly local with no user interaction; there is no public exploit identified at time of analysis, but patch latency should still be short given the breadth of affected platforms.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is classified as CWE-908 (Use of Uninitialized Resource): kernel memory buffers were not fully initialized before being returned or exposed, so a process reaching the affected kernel code path can observe stale contents of previously used kernel memory. This maps to the Apple XNU kernel's memory-handling routines, and Apple's advisory language ('a memory initialization issue was addressed with improved memory handling') indicates a code-level fix that zero-initializes or otherwise sanitizes the buffer before release. The published CPE set confirms the defect spans Apple's entire OS line - apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, and apple:watchos - underlining that the shared kernel code is the affected technology rather than a single application. The vector (AV:L/AC:L/UI:N/C:H/I:N/A:N) confirms local-only, no-user-interaction, high-confidentiality impact with no integrity or availability effect, i.e., a pure kernel information disclosure. Note that the vendor vector carries PR:N while the authoritative assessment requires root (PR:H); the root requirement is the correct operational reading, and the discrepancy should be verified rather than assumed away.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Local app vector (AV:L), no complexity or interaction, but the description requires root so PR:H; impact is a kernel memory read only, hence C:H/I:N/A:N.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app with root privileges may be able to read uninitialized kernel memory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB