Apple Platforms CVE-2026-39869

User interaction is required - the victim must actively open or trigger playback of a maliciously crafted media file, consistent with CVSS UI:R. No authentication or elevated privileges are required by the attacker. The vulnerability is triggered during audio stream parsing, meaning the media file must contain a malformed audio stream payload specifically structured to overflow the parser's input buffer. Exploitation is limited to: (1) the ability to deliver a crafted media file to the target and persuade them to open it (social engineering prerequisite), and (2) an unpatched device running one of the affected OS versions. Fully patched devices running iOS 18.7.9 or 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS/visionOS/watchOS 26.5 are not affected. Impact is limited to process termination (DoS); no code execution, data exfiltration, or persistence is indicated by available data.

All available signals converge on a low-to-medium operational priority. The CVSS base score of 4.3 reflects a network-reachable but user-interaction-required DoS with no confidentiality or integrity impact. EPSS at 0.02% (7th percentile) indicates the vulnerability is currently exploited in the wild at a negligible rate, consistent with SSVC's 'Exploitation: none' classification. CISA KEV absence further confirms no observed active exploitation. SSVC 'Automatable: no' aligns with the UI:R requirement - mass exploitation would require per-victim social engineering. The only notable risk amplifier is the sheer prevalence of the affected platform (billions of Apple devices). However, a process-crash DoS without code execution potential (C:N/I:N in CVSS) limits attacker utility to denial-of-service or potentially crashing a media-processing daemon. No conflict between signals is observed; all three frameworks (CVSS, EPSS, SSVC) agree this is a low-exploitation-likelihood, partial-impact issue appropriate for standard patch cycle rather than emergency response.

An attacker crafts a malicious audio file (e.g., an M4A or MP3 with a malformed stream header) and delivers it via email attachment, iMessage link, or a compromised website. When the victim opens or previews the file on an unpatched Apple device, the audio parsing subsystem copies stream data into a fixed-size buffer without bounds checking, triggering a process crash. No public exploit code or proof-of-concept has been identified at time of analysis.