CVE-2016-1807

Race condition in the Disk Images subsystem in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS...

5.1 MediumPublic exploit

CVE-2016-1807 is a medium vulnerability (CVSS 5.1) in Apple Tvos, published May 20, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. No source names a fixed version.

Race condition in the Disk Images subsystem in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows local users to obtain sensitive information from kernel memory via unspecified vectors.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.69%Down 3.4 points since Feb 4, 2022

What each source reports

NVD Score used 5.1

Record: CVE-2016-1807
CVSS 3.0: 5.1 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 1.9 LowAV:L/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-362
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-1807
Updated: 2026-11-02

EUVDEUVD-2016-2902 No score

Record: EUVD-2016-2902
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4xhq-99m3-rx24 5.1

Race condition in the Disk Images subsystem in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS...

Record: GHSA-4xhq-99m3-rx24
CVSS 3.0: 5.1 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-362
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Apple Mac OSX / iOS Kernel - UAF Racing getProperty on IOHDIXController and testNetBootMethod on IOHDIXControllerUserClient	2016-06-10

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD

References

Show 9 moreShow less