Apple iOS, macOS, tvOS CVE-2026-28972

No special conditions - remote unauthenticated exploitation against default configurations of Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the vulnerability is exploitable over the network without authentication or user interaction. However, the extremely low EPSS score and absence from CISA KEV suggests either: (1) the vulnerable code path is rarely or never reached in typical network scenarios despite being theoretically reachable, (2) the vulnerability requires a specific combination of system state or configuration to trigger (not documented in available advisories), or (3) Apple patched rapidly enough that exploitation window closed before weaponization. Verify against internal telemetry whether your users encounter the vulnerable code path in production deployments.

CVSS 6.5 (Medium) combined with EPSS 0.02% (7th percentile) creates a significant discrepancy. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a severe attack surface - no authentication, no user interaction, low complexity, network-accessible. However, the extremely low EPSS score suggests this vulnerability has received minimal real-world exploitation interest despite public disclosure and patch availability. No CISA KEV listing is indicated, meaning no confirmed active exploitation has been documented. This pattern suggests either: (1) the vulnerability requires specific application-level conditions not covered by the generic CVSS assessment, (2) the attack vector is theoretical or requires specific network conditions, or (3) Apple's installed base rapidly patched before significant exploitation occurred. The integrity impact is rated 'Low' rather than 'High,' indicating kernel memory corruption does not provide complete system compromise. Organizations with current patch deployment should treat this as moderate priority; those with delayed patch cycles should prioritize it higher due to the remote unauthenticated nature.

An attacker sends a specially crafted network packet or triggers a specific network protocol sequence targeting the vulnerable kernel code path. The malformed input bypasses bounds checking in the kernel's packet processing or system call handler, writing data beyond the allocated buffer. This corrupts adjacent kernel memory structures, causing either immediate kernel panic (denial of service) or conditional memory corruption that could enable further exploitation. No user interaction is required; the attack succeeds against default configurations of any device running vulnerable versions with network connectivity.