PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-4662 Apple CVE debrief

CVE-2016-4662 is a high-severity Apple macOS issue affecting systems before 10.12.1. The vulnerable AppleGraphicsControl component can be triggered by a crafted app and may allow arbitrary code execution in a privileged context or cause a denial of service through memory corruption. Apple and NVD list this as a High-severity issue with local access and user interaction required.

Vendor
Apple
Product
CVE-2016-4662
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

macOS administrators, endpoint security teams, and users running versions earlier than 10.12.1 should care most. Systems that allow users to run untrusted or unsigned apps are especially important to review.

Technical summary

The NVD record describes a memory corruption weakness in AppleGraphicsControl (CWE-119). The published CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local exploitation with user interaction required and potentially severe impact if a crafted app is opened or executed on an affected macOS system. The vulnerable version range is macOS up to and including 10.12.0.

Defensive priority

High. Update affected macOS systems to 10.12.1 or later as soon as practical, since the issue can lead to code execution in a privileged context.

Recommended defensive actions

  • Upgrade macOS systems from 10.12.0 and earlier to 10.12.1 or later.
  • Prioritize patching endpoints where users can open third-party or untrusted apps.
  • Review crash reports or endpoint alerts for AppleGraphicsControl-related memory corruption symptoms on legacy systems.
  • Limit execution of untrusted applications through standard endpoint controls and user-awareness measures.
  • Verify inventory for any devices that may still be on pre-10.12.1 builds and remove them from sensitive network segments until patched.

Evidence notes

This debrief is based on the supplied NVD record, which states the affected CPE range as macOS versions ending at 10.12.0, identifies CWE-119, and lists the CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The Apple vendor advisory referenced in the corpus is support.apple.com/HT207275. Published timing used here is the supplied CVE/NVD published timestamp of 2017-02-20T08:59:00.307Z.

Official resources

Published in the supplied source corpus on 2017-02-20 and later modified in NVD on 2026-05-13. No KEV listing is present in the supplied data.