Apple iOS CVE-2026-113907

Exploitation requires the attacker to already have an app running locally on the target Apple device (AV:L, PR:L, no user interaction per UI:N); per the description 'An app may be able to cause unexpected system termination or corrupt process memory.' There is no network vector, no credential/privilege escalation precondition beyond the ability to execute an app, and no special non-default configuration named in the sources - the specific feature or API that triggers the overflow is not described in the available sources. The principal limiting factor is the local attack surface: an attacker must first get code (an app) onto the device, which bounds realistic risk well below a remote flaw; stated impact is limited to a crash/denial of service and partial process-memory corruption, with no confidentiality impact.

This is a moderate-severity, locally-exploitable memory-corruption flaw (CWE-119 buffer overflow) whose signals are internally consistent and point to low real-world urgency despite broad product reach. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, 6.1) describes a flaw that requires code already running on the device - i.e. a malicious or compromised app - with low privileges, yielding high availability impact (crash/unexpected system termination) and only limited integrity impact (process memory corruption) and no confidentiality impact. EPSS is low at 0.22% (12th percentile), SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial, and there is no CISA KEV listing and no proof-of-concept reference in the supplied data. These signals agree: no exploitation observed, low predicted exploitation probability, local-only attack vector, and limited (non-confidentiality, non-code-execution-as-stated) impact. The vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with a patch-when-convenient posture. The one caveat is that buffer overflows in OS components can sometimes be chained toward code execution, but the description claims only termination/memory corruption and no such escalation is evidenced here - treat it as a stability/robustness fix, not a priority remote threat.

A user installs or runs a malicious or compromised app on an Apple device; the app exercises the vulnerable code path to overflow a buffer, corrupting process memory or forcing unexpected system termination (a crash/denial of service). No public exploit code or PoC is referenced in the available data, and exploitation requires the attacker to already be able to run an app locally on the device.