EUVD-2026-78047
GHSA-7xc3-gg48-x9hg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall/run malicious local app
-
ExploitRace shared system state (AC:H window)
-
ImpactTrigger unexpected system termination (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already have code running as an installed app on the victim device (local vector, AV:L, PR:L authenticated app context); the app must win a race condition (AC:H) against system state handling to trigger the crash. Limiting factors: no remote/network reachability, no unauthenticated path, no user interaction of a victim beyond running the malicious app, and success depends on hitting a narrow timing window that is not deterministically controllable. Affected only on versions prior to iOS/iPadOS 27, macOS Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, tvOS 27, visionOS 27, watchOS 27; patched builds are immune. |
| Impact | This is a low-priority availability-only defect. The vendor CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7) describes a locally-installed, already-authenticated app triggering an unexpected system termination via a race condition - no confidentiality or integrity impact (C:N/I:N). The high attack complexity (AC:H) reflects the timing-window nature of race conditions, making reliable triggering non-trivial. EPSS is 0.20% (10th percentile), consistent with the low real-world exploitation likelihood expected for a local DoS with no code-execution or data-theft payoff. There is no CISA KEV listing and no public POC identified, so exploitation status is 'no public exploit identified at time of analysis.' Note a data conflict: the 'Information Disclosure' tag contradicts the CVSS vector (C:N means no information is disclosed) and the description (system termination is availability, not confidentiality) - the tag is mislabeled. Net: a genuine but low-consequence local DoS, not a security priority relative to RCE- or data-exposure-class Apple bugs in the same patch wave. |
| Exploit ScenarioDerived | A user installs a malicious or compromised app from a local source; while running, the app races a shared system resource to force an unexpected system termination (crash/reboot). Impact is limited to a denial-of-service nuisance - no data is read and no code executes with elevated privilege. No public exploit code is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Unexpected system termination in Apple operating systems can be triggered by a locally installed app that wins a race condition in system state handling, affecting iOS/iPadOS before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, tvOS before 27, visionOS before 27, and watchOS before 27. The defect is availability-only (C:N/I:N/A:H) with a local attack vector (AV:L), high attack complexity (AC:H), and low privileges required (PR:L), meaning an authenticated app must hit a narrow timing window to crash the system. No public exploit identified at time of analysis and no confirmation of active exploitation (not in CISA KEV); EPSS is 0.20% (10th percentile), and Apple has released patched versions.
RemediationAI
Vendor-released patch: iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Affected users should upgrade to the corresponding fixed version; Apple security advisories are at support.apple.com/en-us/149034 through 149043 (specifically 149034, 149035, 149036, 149037, 149038, 149042, 149043). Because exploitation requires an installed app and a local race condition, there is no configuration setting that completely disables the vulnerable state handling without breaking system functionality. As a compensating control, organizations can restrict app installation to trusted sources via MDM allowlisting or App Store-only policies, accepting reduced flexibility for users; however, this does not eliminate the race condition itself. No public exploit identified at time of analysis, and patched builds are immune.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a race condition (CWE-362) in Apple's system state handling, where concurrent access to shared state without proper synchronization can lead to a corrupted state and an unexpected system termination. Per the CVSS vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, exploitation requires an attacker to already have code running as an installed app on the victim device (local vector, low privileges), and success depends on winning a narrow timing window (high attack complexity) with no user interaction. The CPE strings confirm affected components are Apple's iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Notably, the provided tags include 'Information Disclosure', but the independent assessment and the CVSS vector show no confidentiality or integrity impact; the sole impact is availability (system crash). Apple addressed the flaw through improved state handling, and patched builds are immune.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Local malicious app (AV:L, PR:L) exploiting a timing-dependent race (AC:H) causes only system termination (A:H) with no confidentiality or integrity impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A race condition was addressed with improved state handling. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB