CVE-2026-64773

Executive Summary

CVE-2026-64773 is a high-severity memory exhaustion vulnerability (CWE-770, Allocation of Resources Without Limits or Throttling) affecting Apple's Container platform. An unauthenticated remote attacker who can reach a container's published TCP port can cause the host's forwarding process to buffer an unbounded amount of client data in memory, potentially exhausting host resources and leading to a denial-of-service condition. The vulnerability is addressed in container version 1.2.0; however, patch confirmation is limited to a single source (NVD) and has not been independently verified. With a CVSS score of 7.5 (High) and no known public exploits, this remains a significant availability risk for organizations exposing containerized services.

Technical Analysis

The vulnerability resides in the data-forwarding mechanism between a published TCP port and the backend container connection. According to the NVD description, the core flaw is an absence of memory-bounding controls during the connection-establishment or data-relay phase. Specifically, an attacker who can reach a container's externally published TCP port can force the host-side forwarding process to accumulate an unbounded volume of client data in memory. This accumulation continues from the time the client initiates the request until the backend container connection completes.

The vulnerability class is CWE-770 (Allocation of Resources Without Limits or Throttling), which covers scenarios where software allocates memory or other resources without imposing a cap on maximum usage or a time limit on the allocation process. In this case, two compounding factors make the attack particularly impactful:

1. Unbounded buffer growth: There is no maximum cap on how much client data can accumulate in the forwarding process's memory.
2. Unbounded wait duration: The attacker can stretch the window between data transmission and backend connection completion indefinitely, allowing memory consumption to grow without interruption.

The attack surface is the host's TCP forwarding pathway. An attacker does not require authentication (CVSS PR:N) and can exploit this from the network (CVSS AV:N) with no user interaction (CVSS UI:N). The confidentiality and integrity impact are none (C:I:N), but the availability impact is high (A:H), indicating that successful exploitation can severely degrade or fully interrupt service availability.

Insufficient technical detail is available in the NVD description to identify specific function names, code paths, or internal data structures involved in the forwarding process. The description does not disclose whether the buffering occurs at the socket level, in an application-layer relay, or within a kernel networking component. Without vendor technical documentation, the precise mechanism remains at the vulnerability-class level: an unauthenticated remote client can drive unbounded memory consumption in a host process by leveraging the TCP forwarding path.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-64773 as of the report date (EPSS score: 0.00315, 23.9% percentile of exploited CVEs; CISA KEV: NO). The following attack chain is inferred from the vulnerability class and the NVD description:

Step 1 — Reconnaissance / Target Identification: An attacker scans for exposed container platforms that publish TCP ports to the network. Shodan can be used to identify hosts running container services with mapped ports. The attacker targets any published TCP port that routes to a backend container.

Step 2 — Flaw Triggering: The attacker establishes a TCP connection to the published port and begins transmitting data without waiting for the backend container to complete its connection handshake or request processing. The attacker deliberately maintains the session in a state where the forwarding process must hold the transmitted data in memory while awaiting backend readiness.

Step 3 — Payload / Execution Method: At the vulnerability-class level, the attack involves sustained transmission of data over the TCP connection to the published port. The attacker repeatedly sends data streams that the forwarding process buffers. By withholding any signal that would allow the backend connection to complete or the buffer to flush, the attacker prevents memory reclamation. The attacker can stretch the wait time arbitrarily, causing the buffered data volume to grow without bound.

Step 4 — Post-Exploitation Impact: Under sustained exploitation, the host's forwarding process consumes increasing amounts of memory until the host exhausts available RAM. This can lead to process crashes, system-wide resource starvation, or a full denial of service affecting all containers and services on the host — not just the targeted container. Because the vulnerability affects the host-level forwarding process, other tenants or workloads on the same host may also experience availability degradation.

Practical attack chains: A single attacker can open multiple concurrent TCP connections to the same published port to multiply memory consumption, or a distributed set of attackers can coordinate to accelerate memory exhaustion. The attack requires no credentials and no user interaction, making it feasible for botnet-scale exploitation if proof-of-concept code is ever released.

Impact Assessment

CVSS Breakdown: The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates a network-exploitable (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) or user interaction (UI:N). The scope is unchanged (S:U), meaning the impact is confined to a single security authority — here, the host forwarding process and its resource pool. Confidentiality and integrity impact are none, while availability impact is high (A:H), resulting in an overall base score of 7.5 (High).

Business Impact: Organizations running Apple Container in production face a credible denial-of-service risk. Successful exploitation can:

• Render containerized services unavailable to end users and internal clients.
• Starve the host of memory, potentially affecting unrelated containers and the host OS itself.
• Force emergency container orchestration interventions, increasing operational overhead.
• Create availability SLA breaches with potential regulatory or contractual consequences.

Affected Systems: The NVD description does not enumerate specific affected versions; the only version constraint provided is the fixed release (container version 1.2.0). All versions prior to 1.2.0 are presumed vulnerable based on the patch disclosure. No OSV package data is available.

Blast Radius: The scope is unchanged (S:U), meaning the compromise of the forwarding process does not directly grant access to other security boundaries. However, the memory exhaustion is host-level, so the operational blast radius extends to all services sharing the host's memory resources.

Exploitability Factors: The attack requires only network access to a published TCP port. Low attack complexity, no required privileges, and no user interaction make this an attractive target for denial-of-service campaigns. The EPSS score of 0.00315 indicates low current exploit probability, but this can change rapidly if public PoCs emerge.

Detection Guidance

Sigma Rule

title: Potential Memory Exhaustion via Unbounded TCP Forwarding Buffer
id: 3f2a1c5e-8b4a-4c7e-9f1d-2a6b8e0c4d5f
status: experimental
description: Detects anomalous memory consumption patterns in container host forwarding processes consistent with CVE-2026-64773 (unbounded data buffering on published TCP ports).
author: Valtersit Threat Intelligence
date: 2026/01/15
tags:
    - attack.t1498
    - attack.t1499
    - cve.2026-64773
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/docker-proxy'
            - '/containerd'
        CommandLine|contains: 'tcp'
    condition: selection and (memory_usage_percent > 70 or memory_usage_bytes > 1073741824)
level: high
falsepositives:
    - Legitimate high-traffic container proxy workloads
    - Normal memory spikes from large file transfers
fields:
    - Image
    - CommandLine
    - memory_usage_bytes
    - ParentImage

YARA Rule

rule CVE_2026_64773_Container_Forwarding_Memory_Exhaustion
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects strings and patterns associated with CVE-2026-64773 exploitation attempts targeting container TCP forwarding processes"
        date = "2026-01-15"
        cve = "CVE-2026-64773"
        severity = "high"
    strings:
        $s1 = "container" ascii wide nocase
        $s2 = "forward" ascii wide nocase
        $s3 = "publish" ascii wide nocase
        $s4 = "tcp" ascii wide nocase
        $s5 = "buffer" ascii wide nocase
        $s6 = "allocate" ascii wide nocase
        $s7 = "connection" ascii wide nocase
        $s8 = "unbounded" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d or uint32(0) == 0x464c457f
        and 3 of ($s*)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-64773 - Potential Container TCP Forwarding Buffer Exhaustion"; flow:established; content:"|00|"; depth:1; dsize:>1500; threshold:type both, track by_src, count 100, seconds 60; classtype:attempted-dos; reference:cve,2026-64773; sid:2026647731; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where event.type == "start" and process.name in ("docker-proxy", "containerd")]
  [process where event.type == "info" and process.name in ("docker-proxy", "containerd")
     and process.memory_usage_percent > 70]

Splunk SPL Query

index=main sourcetype=linux_process
  (process_name="docker-proxy" OR process_name="containerd")
  AND memory_usage_percent > 70
  | stats count by host, process_name, src_ip
  | where count > 5
  | eval threat_score = memory_usage_percent * count
  | sort -threat_score
  | table _time, host, process_name, src_ip, count, memory_usage_percent

Wazuh OSSEC Rule

<group name="local, attacks,">
  <rule id="100647" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">docker-proxy|containerd</field>
    <field name="process.memory_usage_percent">> 70</field>
    <description>CVE-2026-64773: High memory usage in container TCP forwarding process indicating possible unbounded buffer attack</description>
    <group>memory_exhaustion,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The patch is referenced only by NVD and has not been independently confirmed by Apple's official advisory channels or third-party testing. Organizations should verify the availability of container version 1.2.0 through their distribution channels before relying on it.

Immediate Mitigations:

1. Restrict network access to published TCP ports using host-based firewalls or security group rules. Limit exposure to trusted networks and IP ranges only.
2. Deploy rate-limiting or connection-throttling proxies in front of container services to cap per-client data transmission rates.
3. Set memory limits on container host forwarding processes via cgroups or systemd resource controls to bound the memory that can be consumed before OOM killing occurs.
4. Monitor memory usage of docker-proxy/containerd processes and alert on sustained high usage.

Patch/Upgrade Steps:

1. Obtain container version 1.2.0 from the vendor's official repository or package manager.
2. Test the upgrade in a staging environment, verifying that existing container workloads function correctly after the update.
3. Schedule a maintenance window and apply the upgrade to production hosts. Roll out gradually, starting with non-critical hosts.
4. After patching, re-run service validation tests and confirm the forwarding process handles sustained TCP connections without unbounded memory growth.

Long-Term Hardening:

1. Enforce a policy of least exposure for all container-published ports. Audit port mappings regularly and remove those not strictly required.
2. Implement network segmentation so container hosts are not directly reachable from untrusted networks.
3. Establish baseline memory usage for forwarding processes and deploy automated alerting when thresholds are breached.
4. Maintain an inventory of all container host versions and subscribe to vendor security notifications for timely patch adoption.
5. Incorporate this CVE into red-team and penetration testing procedures to validate detection coverage.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-64773
2. NVD CWE Reference: https://cwe.mitre.org/data/definitions/770.html
3. Apple Container Product Documentation (verify fixed version 1.2.0 availability): https://developer.apple.com/documentation
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-64773 not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS Score Information: https://www.first.org/epss/

Threat Actor Activity: As of this report, no known threat actor campaigns have been observed exploiting CVE-2026-64773. There is no evidence of exploit-in-the-wild activity, no public PoC, and no exploit code available. The CVE is not listed in CISA KEV. Organizations should monitor vendor advisories and threat intelligence feeds for updated information, as patch confirmation remains pending independent verification.