Threat Intelligence Report — CVE-2026-65413

Executive Summary

CVE-2026-65413 is an integer overflow vulnerability (CWE-190) in Apple macOS, addressed through improved input validation in the macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7 releases. An attacker who can convince a local user to open a malicious application or crafted input can trigger the overflow, resulting in a denial-of-service condition against the affected component. The flaw carries a moderate CVSS base score of 5.5, requires local access and user interaction, has no known public exploit, and is not listed in CISA KEV.

Technical Analysis

The CVE is classified under CWE-190 (Integer Overflow or Wraparound). Per the NVD description, the vulnerability was remediated "with improved input validation," indicating that the root cause is a failure to correctly bound or validate a numeric value derived from attacker-influenced input before it is used in a memory or resource operation.

An integer overflow occurs when an arithmetic operation produces a value that exceeds the maximum representable value for its data type, causing the result to wrap around to an unexpectedly small (or negative) value. In memory-unsafe and resource-management contexts, this defect class typically manifests in one of two ways:

• Under-allocation: A size calculation used for allocating a buffer (e.g., count * element_size) wraps to a small value, leading to heap/stack corruption when the buffer is later written with the logically larger dataset.
• Bounds-check bypass: A length or index check uses a wrapped value, allowing access beyond an intended boundary, or a loop counter wraps and produces a runaway condition.

The precise arithmetic expression, variable, function, or subsystem affected is not disclosed in the CNA/NVD description. The description states only that "an app may be able to cause a denial of service," and does not enumerate a specific component, library, or API surface. No function names, symbols, file paths, or parameters are provided, so this report deliberately avoids asserting any.

Attack surface: The vector is local (AV:L) with user interaction required (UI:R), meaning the flaw is reachable by a process running in the context of the logged-in user — most plausibly a bundled or downloaded application that supplies crafted input to a macOS service, system component, or framework. Successful trigger results in a denial of service rather than memory disclosure or code execution (per the description), though the CVSS vector's C:H reflects the confidentiality-impact component of the Apple baseline metric set and should be read alongside the vendor's DoS characterization.

Note on CVSS subscores: The provided vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N yields a base score of 5.5. Readers should note the internal tension: the NVD prose characterizes the outcome as a denial of service (availability), while the vector encodes a confidentiality (C:H) weighting with no availability subscore. This report uses the score exactly as provided and flags the discrepancy as a data-quality caveat rather than reconciling it.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available. The chain below is inferred at the vulnerability-class level only; no specific implementation details are fabricated.

1. Reconnaissance / target identification. An adversary identifies a macOS host running a vulnerable build (Golden Gate < 27, Sequoia < 15.8, or Tahoe < 26.7). Because the flaw requires user interaction and local execution context, the adversary targets the user rather than a network-exposed service — for example, via social engineering, a malicious download, or a compromised legitimate application.

2. Triggering the integer overflow. The attacker delivers or induces execution of an application that supplies crafted input to the affected macOS component. The input is crafted so that a numeric field — a length, count, size, or offset — causes the vulnerable arithmetic to wrap. The overflow defeats the intended bounds validation, and the component proceeds with an invalid, wrapped value.

3. Execution method (class level). The overflow leads to an out-of-bounds condition or a resource calculation failure that the affected component cannot handle safely, resulting in a crash or hang. At the class level, this is analogous to a length-field overflow triggering an under-sized allocation followed by an oversized write, or an index wrap bypassing a range check. The exact primitive is not documented.

4. Post-exploitation impact. The described outcome is a denial-of-service condition affecting the application or component running in the user's context — availability impact to the user's session and potentially to system services the component supports. No escalation of privilege, code execution, or data exfiltration is claimed in the NVD description.

Impact Assessment

The vulnerability primarily affects the availability of the targeted macOS application or component, consistent with the "denial of service" characterization. However, the supplied CVSS vector weights impact as C:H/I:N/A:N, which is inconsistent with the DoS prose; threat teams should treat the "availability degradation" framing as the operative operational risk based on the description, while using the 5.5 base score exactly as provided for prioritization.

Blast radius: Individual macOS endpoints at the user-interaction boundary. Because exploitation requires local access and user interaction (AV:L, UI:R), there is no wormable or remotely unauthenticated propagation path. Risk is concentrated in user workstations where untrusted or crafted input can reach the affected component, and in enterprise fleets running the vulnerable builds prior to the fixed releases.

Business impact: Potential productivity loss from application crashes or forced restarts, user-session disruption, and — where the impacted component is shared — collateral instability of dependent services. The EPSS score of 0.00155 (5.0th percentile) and absence from CISA KEV indicate low observed exploitation likelihood to date.

Detection Guidance

Exploitation requires a local application to feed malformed input into a macOS system component; this is not a network-observable event. The following rules are generic templates aligned to the vulnerability class, intended for tuning — not turnkey signatures.

Sigma Rule

title: Suspicious macOS Application Crash / DoS Indicative of Integer Overflow Exploit
id: 8f3c1a72-0f4d-4b6e-9c2a-cve202665413
status: experimental
description: Detects repeated unexpected termination of macOS applications/processes consistent with a local denial-of-service trigger.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65413
author: valtersit.com
date: 2026/01/01
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/CrashReporter'
      - '/ReportCrash'
  condition: selection
falsepositives:
  - Normal application crashes, developer testing
level: low
tags:
  - attack.t1499

YARA Rule

rule CVE_2026_65413_macOS_IntOverflow_Marker
{
    meta:
        author = "valtersit.com"
        description = "Heuristic detection for oversized length/size fields in crafted input files targeting macOS components (CWE-190). Generic class-level template."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65413"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $mz = { 4D 5A }
        $macho = { FE ED FA CE }
        $macho64 = { FE ED FA CF }
    condition:
        (uint32(0) == 0x464c457f) or ($mz at 0) or ($macho at 0) or ($macho64 at 0)
}

Note: A precise YARA signature is not feasible because no file format, strings, or component identifiers are disclosed for this CVE. The rule above is a format-scoping stub for triage of suspicious local payloads and must not be treated as a reliable detection.

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-65413 macOS integer overflow - local DoS (low confidence, no network signature available)"; classtype:attempted-dos; sid:2026654130; rev:1;)

Note: CVE-2026-65413 has no documented network reachability. Suricata cannot meaningfully detect this local, user-interaction-driven flaw; the rule is a placeholder and should be disabled unless supporting telemetry exists.

Elastic Detection

process where event.type == "start" and
  process.parent.name : ("CrashReporter", "ReportCrash") and
  process.executable : "/Applications/*"

Purpose: surfaces crash-report activity tied to application termination, which may correlate with repeated DoS triggers on macOS endpoints.

Splunk SPL Query

index=os sourcetype=macos_unified_log ("ReportCrash" OR "CrashReporter" OR "segmentation fault" OR "did not exit cleanly")
| stats count by host, process, _time
| where count > 3

Purpose: identifies hosts with recurrent process crashes that may indicate repeated exploitation attempts or inputs triggering the overflow.

Wazuh OSSEC Rule

<group name="macos,cve-2026-65413,">
  <rule id="100413" level="6">
    <decoded_as>json</decoded_as>
    <match>ReportCrash|CrashReporter|did not exit cleanly|segmentation fault</match>
    <description>CVE-2026-65413: macOS application crash/DoS activity detected (possible integer overflow trigger)</description>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED) — the fix is attributed to NVD only and has not been independently confirmed; validate against Apple's official security advisory before relying solely on this listing.

1. Immediate mitigations.

   • Restrict execution of untrusted or unvetted application bundles on macOS endpoints via application allowlisting (e.g., Gatekeeper, MDM-enforced policy, or endpoint control).
   • Enforce user-awareness controls to reduce the likelihood of users opening crafted input or untrusted apps (the UI:R vector is the gating requirement).
   • Ensure endpoint protection/EDR is configured to collect crash telemetry so repeated DoS triggers are visible.

2. Patch / upgrade steps.

   • Upgrade affected hosts to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 (or later), as these are the releases in which Apple states the issue is fixed.
   • Confirm the actual Apple security advisory identifier before deployment; the CVE-to-patch mapping is currently single-source.
   • Stage updates through normal change management; rebooting to complete OS updates is required for full remediation.

3. Long-term hardening.

   • Maintain a current macOS fleet inventory with enforced minimum-version baselines and reduced patch-latency windows.
   • Monitor Apple security releases continuously and subscribe to vendor advisory feeds.
   • Retain crash/DoS telemetry for correlation and trend analysis to detect recurrence after patching.

References

• NVD — CVE-2026-65413: https://nvd.nist.gov/vuln/detail/CVE-2026-65413
• CWE-190 (Integer Overflow or Wraparound): https://cwe.mitre.org/data/definitions/190.html
• MITRE ATT&CK T1499 (Endpoint Denial of Service): https://attack.mitre.org/techniques/T1499/
• Apple Product Security Releases (verify against the macOS Golden Gate 27 / Sequoia 15.8 / Tahoe 26.7 advisories): https://support.apple.com/en-us/HT201222
• FIRST EPSS: https://www.first.org/epss/

Exploit-in-the-wild / threat actor note: No public exploit, PoC, or known threat-actor campaign is associated with CVE-2026-65413. The CVE is not in the CISA KEV catalog, and EPSS is 0.00155 (5.0th percentile), indicating low predicted real-world exploitation activity at time of writing.

Analyst caveats: Several fields (affected version specifics, workarounds, vendor fix reference) were empty in the source data. The CVSS vector's C:H weighting is inconsistent with the NVD's denial-of-service description; this report preserves the supplied score as instructed and flags the inconsistency. Detection content is provided at the vulnerability-class level because no component, function, path, or parameter details are disclosed.