PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7618 Apple CVE debrief

CVE-2016-7618 is a high-severity Apple macOS issue in the Foundation component that was fixed in macOS 10.12.2 and earlier affected versions up to 10.12.1. A specially crafted .gcx file can trigger memory corruption, leading to an application crash or potentially arbitrary code execution. Because exploitation depends on file handling and user interaction, organizations should prioritize patching systems that may open untrusted files or process .gcx content.

Vendor
Apple
Product
CVE-2016-7618
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

MacOS users and administrators running versions before 10.12.2, especially environments that process untrusted files or allow users to open externally supplied .gcx content. Security teams should treat this as a priority for endpoint patching and exposure reduction.

Technical summary

NVD classifies the flaw as CWE-119 (improper restriction of operations within the bounds of a memory buffer). The affected range is macOS versions up to and including 10.12.1. A crafted .gcx file can corrupt memory in the Foundation component, which may cause a crash or enable code execution. The NVD CVSS vector is CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating user interaction is required even though the description refers to remote attackers.

Defensive priority

High. The issue has a 7.8 CVSS score and affects a core macOS component with potential confidentiality, integrity, and availability impact. Systems on macOS 10.12.1 or earlier should be patched urgently.

Recommended defensive actions

  • Upgrade affected Macs to macOS 10.12.2 or later.
  • Review exposure to untrusted .gcx files and restrict handling where practical.
  • Prioritize patching endpoints that regularly open externally supplied documents or media files.
  • Use endpoint protection and user-awareness controls to reduce the chance of opening untrusted files.
  • Validate remediation by confirming affected hosts are no longer on macOS 10.12.1 or earlier.

Evidence notes

The supplied NVD record and Apple advisory references identify macOS before 10.12.2 as affected and point to Apple support advisory HT207423. The NVD record lists the flaw as CWE-119 and provides a CVSS vector of CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The text description says the issue can be triggered via a crafted .gcx file and may lead to arbitrary code execution or denial of service. The CVSS vector suggests user interaction is required, so the debrief avoids overstating fully remote exploitation.

Official resources

Publicly disclosed on 2017-02-20 per the supplied CVE publication timestamp; the record was last modified on 2026-05-13. Use the publication date for disclosure timing, not the later modification date.