A buffer overflow issue was discovered in several versions of macOS; the flaw was fixed by adding improved bounds checking. The vulnerability allows a local or privileged application to execute arbitrary code outside its sandbox or with certain elevated privileges. The flaw aligns with CWE-120, a classic stack-based buffer overflow. The potential impact is the ability for malicious code to run with higher privileges, potentially compromising data and system integrity.

Apple macOS is affected. The critical fixes are available in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. No other specific versions were listed as affected or patched.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is below 1 %, suggesting exploitation probability is currently very low but not zero. The vulnerability is not listed in CISA’s KEV catalog, implying no widely known active exploits. Based on the description, the flaw permits local or privileged applications to perform arbitrary code execution outside their sandbox or with elevated privileges, which could compromise system integrity and data confidentiality. The attack vector is inferred to require a local or privileged application to trigger a buffer overflow, as the vulnerability description does not explicitly state remote code execution capabilities.