iOS and iPadOS CVE-2026-43667

Exploitation requires the attacker to occupy a privileged network position - meaning on-path between the victim device and a network endpoint (e.g., rogue access point operator, ARP-cache poisoner on LAN, or ISP/carrier-level adversary). The CVSS UI:R flag confirms that some form of user interaction with a network-connected feature is required, though the exact trigger (e.g., visiting a site, receiving a message, connecting to a service) is not specified in the advisory. The absence of required authentication (PR:N) means no account or credential on the target device is needed. Exploitation is limited by: (1) the need for privileged network positioning, ruling out opportunistic internet-scale attacks; (2) the requirement for user interaction; and (3) impact limited strictly to availability (no code execution, no data exfiltration). Devices on isolated or fully trusted networks with no exposure to untrusted Wi-Fi or cellular interception are at significantly reduced risk.

The provided CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects a network-reachable, unauthenticated DoS with no confidentiality or integrity impact. However, the description's qualifier - 'attacker in a privileged network position' - introduces a meaningful real-world constraint not fully captured by AC:L; network positioning requirements (e.g., on-path interception, same LAN segment, ISP-level access) are closer to AC:H in practice, suggesting the true exploitability may be lower than the CVSS score implies. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified. No CISA KEV listing exists, and no public exploit code has been reported. Combining these signals: the vulnerability is moderately severe in theory (complete availability loss on the device) but operationally constrained by the need for network positioning and user interaction, making mass-exploitation scenarios unlikely compared to a straightforward unauthenticated remote code execution. Priority should be elevated for deployments in hostile network environments (public Wi-Fi, untrusted cellular, corporate networks with insider-threat exposure).

An attacker who has positioned themselves on the same network segment as the victim device - for example via a rogue Wi-Fi access point or ARP-poisoning on a shared LAN - sends crafted network traffic that a system service on the iOS/iPadOS device evaluates. When the user's device processes the malicious input (e.g., during a connection handshake or data exchange), the assertion failure is triggered, causing the relevant process to crash and producing a denial-of-service condition. No public proof-of-concept code has been identified, so exploitation currently requires independent research to identify the precise vulnerable code path.