PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7603 Apple CVE debrief

CVE-2016-7603 is a local denial-of-service vulnerability in Apple’s CoreStorage component affecting macOS versions before 10.12.2. According to the official CVE/NVD record, the issue can be triggered by a local user and results in a NULL pointer dereference, with availability impact but no documented confidentiality or integrity impact in the supplied sources. Apple’s advisory is referenced by NVD as the vendor source for the fix. For defenders, the main concern is systems running macOS 10.12.1 or earlier, especially endpoints where untrusted local accounts, shared logins, or other local execution opportunities exist. The vulnerability is rated medium severity (CVSS 5.5) and is primarily a stability and availability issue rather than a remote code execution flaw.

Vendor
Apple
Product
CVE-2016-7603
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

MacOS administrators, endpoint security teams, and anyone responsible for shared or multi-user Mac systems should care most. Systems running macOS 10.12.1 or earlier are directly in scope.

Technical summary

The NVD record identifies a vulnerability in Apple CoreStorage with CWE-476 (NULL pointer dereference). The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction (UI:N). Impact is availability-only (A:H). The official record lists macOS versions through 10.12.1 as vulnerable, with 10.12.2 as the fixed release. The supplied sources do not provide additional exploitation detail beyond "unspecified vectors."

Defensive priority

Medium. This is not a remote compromise issue, but it can be used by a local user to disrupt system availability. Priority should be higher on shared Macs or environments where local execution is more likely.

Recommended defensive actions

  • Upgrade affected Macs to macOS 10.12.2 or later.
  • Inventory systems running macOS 10.12.1 or earlier and prioritize them for remediation.
  • Treat shared or multi-user Macs as higher risk because the issue is locally triggerable.
  • Review endpoint stability logs for repeated CoreStorage-related crashes or abnormal reboots as part of general validation after patching.
  • Use standard least-privilege and local-account hygiene to reduce exposure to local abuse paths.

Evidence notes

The supplied corpus supports these points: Apple/macOS is the affected platform; versions before 10.12.2 are vulnerable; the issue is in CoreStorage; the flaw is a NULL pointer dereference; impact is denial of service; and the NVD weakness mapping is CWE-476. The NVD vector is CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, which matches a local availability issue. The sources do not describe weaponized steps, payloads, or broader impact beyond DoS.

Official resources

Published date used here is the CVE/NVD publication date of 2017-02-20. Later modification timestamps in the source metadata are not treated as the issue date.