CVE-2017-13876

HIGH

Apple <11.2, <10.13.2, <4.2, <11.2 - RCE/DoS

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-13876. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages an integer overflow in the `posix_spawn` syscall on 32-bit macOS/iOS systems, allowing an out-of-bounds write in kernel memory. The PoC demonstrates a heap overflow primitive by manipulating the `port_actions` structure, targeting Apple Watch Series 3 running WatchOS 4.0.1.

Description

An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · textdosmultiple
https://www.exploit-db.com/exploits/43325

This exploit leverages an integer overflow in the `posix_spawn` syscall on 32-bit macOS/iOS systems, allowing an out-of-bounds write in kernel memory. The PoC demonstrates a heap overflow primitive by manipulating the `port_actions` structure, targeting Apple Watch Series 3 running WatchOS 4.0.1.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: macOS/iOS (32-bit) kernel, specifically WatchOS 4.0.1 on Apple Watch Series 3
No auth needed
Prerequisites: 32-bit macOS/iOS device (e.g., Apple Watch Series 3) · Ability to execute arbitrary code in userspace
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (9)

Core 9
Core References
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT208331
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT208327
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT208325
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1039966
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1039953
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT208334
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1039952
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/102100
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43325/

Scores

CVSS v3 7.8
EPSS 0.0511
EPSS Percentile 91.3%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-119
Status published
Products (4)
apple/iphone_os < 11.2
apple/mac_os_x < 10.13.2
apple/tvos < 11.2
apple/watchos < 4.2
Published Dec 25, 2017
Tracked Since Feb 18, 2026