PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7633 Apple CVE debrief

CVE-2016-7633 is a local use-after-free in Apple’s Directory Services component affecting macOS before 10.12.2. The NVD record rates it High severity and describes outcomes of local privilege escalation or denial of service. Because the attack vector is local and requires low privileges, this is primarily a patch-management concern for any system that could still be running an affected macOS release.

Vendor
Apple
Product
CVE-2016-7633
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

macOS administrators, endpoint security teams, and anyone responsible for systems running macOS 10.12.1 or earlier.

Technical summary

NVD classifies the weakness as CWE-416 (use-after-free). The affected CPE scope covers Apple macOS versions up to and including 10.12.1. The CVSS v3.0 vector listed by NVD is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local issue with potentially high impact if exploited.

Defensive priority

High for any environment that may still have macOS 10.12.1 or earlier in service; otherwise historical. Prioritize validation and removal of legacy affected systems.

Recommended defensive actions

  • Upgrade affected Macs to macOS 10.12.2 or later.
  • Inventory endpoints to confirm no systems remain on macOS 10.12.1 or earlier.
  • Limit local access on systems that cannot be upgraded immediately.
  • Apply standard endpoint hardening and least-privilege controls to reduce local exploitation risk.
  • Verify patch compliance against Apple’s advisory referenced in the NVD record.

Evidence notes

This debrief is based on the supplied NVD record and linked references. The source corpus provides the affected platform range (macOS through 10.12.1), the weakness class (CWE-416), and the local high-severity CVSS vector. The full vendor advisory text was not included in the corpus, so no additional technical details are asserted beyond the supplied summary metadata.

Official resources

Publicly disclosed on 2017-02-20 per the CVE/NVD record. Use the published date for timing context; the later modified date reflects record updates, not the issue date.