PatchSiren cyber security CVE debrief
CVE-2016-7609 Apple CVE debrief
CVE-2016-7609 is a local denial-of-service issue in Apple’s AppleGraphicsPowerManagement component on macOS versions before 10.12.2. According to the CVE record and NVD metadata, the flaw is a NULL pointer dereference that can be triggered by a local user, causing an availability impact without any indicated confidentiality or integrity impact.
- Vendor
- Apple
- Product
- CVE-2016-7609
- CVSS
- MEDIUM 6.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2017-02-20
- Original CVE updated
- 2026-05-13
- Advisory published
- 2017-02-20
- Advisory updated
- 2026-05-13
Who should care
Mac administrators, endpoint security teams, and support staff responsible for older macOS systems should care most. Any environment that still has macOS versions earlier than 10.12.2 should treat this as a patching and asset-inventory item.
Technical summary
The NVD record describes a NULL pointer dereference in AppleGraphicsPowerManagement, a macOS component related to graphics power management. The vulnerability is local-only (CVSS vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and the published CVE description indicates denial of service via unspecified vectors. NVD maps the issue to CWE-476 and lists affected macOS versions through 10.12.1, with 10.12.2 as the first fixed release referenced by the description.
Defensive priority
Medium. The issue is limited to local denial of service and does not indicate code execution or data compromise, but it affects a core system component and should be remediated on any still-supported or still-deployed affected macOS systems.
Recommended defensive actions
- Upgrade affected macOS systems to 10.12.2 or later.
- Inventory endpoints and confirm whether any hosts remain on macOS 10.12.1 or earlier.
- Prioritize remediation for shared workstations and systems where local user access is broadly available.
- Track crashes or unexpected reboots on older macOS hosts as part of routine stability monitoring.
- Use Apple’s official security advisory referenced by NVD (HT207423) to confirm applicable fixed builds and release details.
Evidence notes
This debrief is based on the supplied CVE description and NVD metadata only. Supported facts include: AppleGraphicsPowerManagement is the affected component; the issue is a NULL pointer dereference (CWE-476); the impact is local denial of service; the CVSS vector is AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; and the affected macOS range ends at 10.12.1. The Apple support advisory URL is referenced in NVD, but its contents were not directly provided in the corpus.
Official resources
Publicly disclosed in the CVE/NVD record on 2017-02-20. The supplied timeline does not include a KEV listing or later exploitation-driven disclosure context.