Apple iOS iPadOS CVE-2026-43653

The attacker must be present on the same local network segment (Wi-Fi, Ethernet, or similar Layer-2 adjacency) as the target device - remote internet-based exploitation is not indicated by the description. No authentication is required and no user interaction is described. The vulnerability is present on default configurations of affected iOS, iPadOS, macOS, and tvOS versions without requiring any non-default feature to be enabled, based on the absence of conditional language in the description. Exploitation is limited to denial-of-service; no confidentiality or integrity impact is described despite the misleading NVD CVSS vector. The non-automatable SSVC rating suggests reliable mass exploitation is not straightforward, possibly due to protocol-specific timing or state requirements.

IMPORTANT INCONSISTENCY: The NVD-supplied CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is directly contradicted by the CVE description on two metrics. First, the description states 'attacker on the local network,' implying AV:A (Adjacent), not AV:L (Local). Second, the only stated impact is denial-of-service, yet the vector encodes C:H (high confidentiality impact) and A:N (no availability impact) - the inverse of what a DoS vulnerability would produce. This vector should not be trusted for triage without vendor clarification. Real-world risk is low-to-moderate: EPSS is 0.02% (5th percentile), no KEV listing, SSVC rates exploitation as none and automatable as no, and technical impact as partial. The adjacent-network requirement limits exposure to attackers physically or logically on the same broadcast domain. The consequence is availability disruption, not data theft or code execution, further reducing urgency. Defenders on enterprise networks with controlled Layer-2 segmentation face minimal immediate risk.

An attacker connected to the same Wi-Fi network or local subnet as a target Apple device crafts and transmits a sequence of malformed network packets targeting a local-link service vulnerable to the memory flaw. The service fails to bound its memory consumption in response, exhausting system resources and causing the device or a specific service to become unresponsive. No authentication or user interaction is required beyond network adjacency. No public proof-of-concept is known at this time.