Apple iOS CVE-2026-28959

Exploitation requires a malicious or malformed application to already be present and executing on the target Apple device - Apple's description ('An app may be able to cause unexpected system termination') makes local, app-level access the operative precondition, not network reachability. Limiting factors: the attacker must get their app installed and run (Apple's app review, code signing, sandboxing, and MDM allowlisting all impede this), the device must be on a pre-fix OS build, and the achievable outcome is only unexpected termination (availability loss) - no confidentiality or integrity impact. Note the CVSS vector's AV:N/PR:N conflicts with this local-app framing and should be verified against Apple's advisory before treating the bug as remotely triggerable.

Signals conflict on attack vector and should be reconciled before prioritization. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) implies remote, unauthenticated, network-reachable exploitation, but the description explicitly says 'An app may be able to cause unexpected system termination' - i.e., a locally installed app is the attacker, which is AV:L, not AV:N. This is a common discrepancy in Apple-sourced CVSS records; the local-app reading is more credible and materially lowers real-world risk. Supporting this, EPSS is 0.03% (9th percentile), SSVC records Exploitation: none and Technical Impact: partial (availability only, no code execution), and the issue is absent from CISA KEV. SSVC lists Automatable: yes, but with only a DoS payoff and a local-app precondition the practical value to an attacker is low. Net: this is a low-to-moderate real priority - a crash-only bug gated behind running attacker-controlled code on the device - despite the 7.5 'High' base score.

An attacker publishes or sideloads a malicious app (or ships a malformed input to a legitimate app) that feeds oversized data into the vulnerable component, overflowing a fixed-size buffer. When the victim runs the app, the memory corruption forces the process or the device to terminate unexpectedly, producing a denial of service. No public POC is identified, and the impact is limited to a crash rather than code execution or data theft.