Cyber Resilience

CVE-2026-39877

Memory Safety in Apple Macos 14.0 – 14.8.8

Memory Safety
Published
27 July 2026
Modified
29 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0012 2th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-39877 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Apple Macos. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-39 (Process Isolation) and SI-16 (Memory Protection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An app may be able to disclose kernel memory.

CWE(s)
CWE-119

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1212 Exploitation for Credential Access Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
attack.mitre.org →
Why these techniques?

Kernel memory disclosure via memory corruption enables local exploitation for privilege escalation (T1068) or credential access (T1212) by leaking sensitive kernel data or addresses.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-64698Shared CWE-119
CVE-2026-4010Shared CWE-119
CVE-2026-22167Shared CWE-119
CVE-2025-6693Shared CWE-119
CVE-2025-5869Shared CWE-119
CVE-2026-64749Shared CWE-119
CVE-2023-49618Shared CWE-119
CVE-2026-14607Shared CWE-119
CVE-2026-64697Shared CWE-119
CVE-2026-12216Shared CWE-119

Affected Assets

apple
macos
14.0 — 14.8.8 · 15.0 — 15.7.8

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-16 Memory Protection
  • SC-39 Process Isolation
  • SC-3 Security Function Isolation
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V17.3.2

Mitigating Controls (NIST 800-53 r5) AI

SI-16 Memory Protection good match
prevent

Directly implements memory protections to block unauthorized access and corruption that enables kernel memory disclosure.

SC-39 Process Isolation good match
prevent

Enforces separate execution domains so a user-space app cannot corrupt or read kernel memory.

SC-3 Security Function Isolation partial match
prevent

Isolates kernel security functions from non-security code, limiting the impact of memory corruption bugs.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices (bounds checking, safe APIs, reviews) directly prevent this class of flaw.

ID.RA-01 partial match
prevents

Vulnerability scanning and code analysis directly surface buffer-boundary flaws.

ID.RA-08 partial match
prevents

Receiving and triaging vulnerability disclosures commonly includes buffer-related reports.

PR.AT-02 partial match
prevents

Developer training on secure coding reduces introduction of memory-buffer errors.

PR.PS-02 partial match
prevents

Patching replaces vulnerable code containing buffer-boundary defects.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development catches out-of-bounds accesses before release, covering most instances of the weakness.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle mandates memory-safety practices that directly prevent buffer-boundary violations.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify memory-safety rules, but do not prescribe implementation details.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture and engineering principles include memory-safe design patterns that mitigate buffer overflows.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly forbid unsafe buffer operations, directly eliminating CWE-119.

References