EUVD-2026-78046
GHSA-9h63-3262-p24h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost/send crafted image to victim
-
ExploitVictim app opens the image
-
ExecutionOverflow defeats bounds check in image parser
-
ImpactApp terminates unexpectedly (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to process an attacker-supplied maliciously crafted image in an affected Apple OS (iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27 prior to the fix). The limiting factor is mandatory user interaction (UI:R) - the victim must open or render the image (e.g., view a web page, message, or attachment); there is no self-propagating or zero-click path indicated. Impact is bounded to unexpected termination of the processing application (A:L), not system compromise, code execution, or data disclosure, so realistic risk is a recoverable crash rather than device takeover. |
| Impact | This is a low-to-moderate priority defect that reads as a genuine but low-impact issue rather than a high-severity emergency. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, base 4.3) and the description agree cleanly: a maliciously crafted image causes unexpected app termination only - no confidentiality (C:N), no integrity (I:N), and only limited availability impact (A:L), meaning a single application crashes rather than the whole system or device. EPSS is low at 0.21% (12th percentile), it is NOT in CISA KEV, and no public POC is identified - all three signals are consistent with each other and with the modest CVSS. There is no conflict between the network attack vector and the DoS-only impact: the image can be delivered remotely (web page, message, email attachment) but requires the victim to process it (UI:R), which is why AV:N coexists with a low base score. SSVC framing: exploitation is 'none' observed, technical impact is 'partial' (crash only), and while parsing untrusted images is somewhat automatable, the payoff is merely a recoverable app crash. Bottom line: patch in normal cycle; this is a low-real-risk availability bug, not a code-execution threat despite the 'buffer overflow' framing. |
| Exploit ScenarioDerived | An attacker crafts a malformed image that overflows a bounds check in Apple's image-processing code and hosts or sends it (web page, iMessage, email). When the victim's app renders the image, the overflow triggers and the app terminates unexpectedly. No public exploit code is identified, and the impact is limited to a recoverable crash - no code execution or data disclosure is indicated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Improper bounds checking during image processing on unpatched Apple operating systems lets a crafted image crash the application that renders it, affecting iOS and iPadOS before 27, macOS Golden Gate before 27, tvOS before 27, visionOS before 27, and watchOS before 27. The defect is scored 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), meaning an unauthenticated remote attacker can trigger it only if the victim opens or renders the malicious image, and the outcome is limited to unexpected application termination rather than code execution, data disclosure, or integrity loss. No public exploit code has been identified and there is no confirmed active exploitation; EPSS is a low 0.21% (12th percentile), so this is a low-to-moderate priority issue rather than an emergency.
RemediationAI
Vendor-released patch: update to iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, or watchOS 27, which contain the improved bounds checking that resolves the overflow; apply the corresponding Apple advisory from the reference list (https://support.apple.com/en-us/149034 through https://support.apple.com/en-us/149038) for each platform. Because exploitation requires the victim to open a maliciously crafted image, interim compensating controls are limited: avoid opening or previewing untrusted images on unpatched devices, disable automatic image previews in messaging and mail clients, and restrict web content that can rapidly render widely supported image formats - accepting that these measures reduce convenience and can be bypassed by user action. No public exploit is known, so there is no need for emergency out-of-band mitigation; schedule the upgrade through normal patch management, prioritising users who routinely handle untrusted image attachments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic buffer overflow (CWE-120) arising from insufficient bounds checking in the image-decoding path of Apple's operating systems, where an oversized or malformed image causes a write beyond the intended buffer boundary. The affected code is shared across Apple's platform family, which is why the CPE inventory spans cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:tvos, cpe:2.3:a:apple:visionos, and cpe:2.3:a:apple:watchos, all marked with wildcard versions below the 27 releases. Exploitation is network-reachable in the sense that the malicious image can arrive over the web, messaging, email, or file sharing, but the CVSS vector's UI:R component makes victim interaction mandatory - there is no zero-click or self-propagating path indicated, and PR:N means no authentication is needed by the attacker. The bounded A:L impact reflects that the memory corruption is caught or confined to the decoding process, producing a recoverable crash rather than a device takeover, and the C:N/I:N components confirm no confidentiality or integrity effect.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Image can be delivered remotely (AV:N) but requires the victim to open it (UI:R); no auth (PR:N); impact is a single-app crash only, so C:N/I:N/A:L.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB