CVE-2015-7987: Apple Airport Base Station Firmware

Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days.

Multiple buffer overflows in mDNSResponder before 625.41.2 allow remote attackers to read or write to out-of-bounds memory locations via vectors involving the (1) GetValueForIPv4Addr, (2) GetValueForMACAddr, (3) rfc3110_import, or (4) CopyNSEC3ResourceRecord function.

Affected products

• Apple Airport Base Station Firmware: from 7.6, before 7.6.7 (fixed in 7.6.7); from 7.7, before 7.7.7 (fixed in 7.7.7)
• Apple iPhone OS: from 9.0, before 9.1 (fixed in 9.1)
• Apple Mac OS X: from 10.9, before 10.9.5 (fixed in 10.9.5); from 10.10.0, before 10.10.5 (fixed in 10.10.5); from 10.11.0, before 10.11.1 (fixed in 10.11.1)
• Apple Mdnsresponder: before 625.41.2 (fixed in 625.41.2)
• Apple watchOS: before 2.1 (fixed in 2.1)

Published 2016-06-26. Last modified 2026-06-17.