Apple iOS CVE-2026-43780

Exploitation requires the victim to locally process a maliciously crafted texture in a vulnerable Apple graphics/texture-parsing component; the CVSS vector's AV:L and UI:R confirm local access plus user interaction (opening or rendering the attacker-supplied texture) are mandatory. It affects unpatched iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe/tvOS/visionOS/watchOS before 26.6. Limiting factors that reduce real-world risk: no remote network vector, the user must actively process the crafted texture, and the demonstrated impact is app termination rather than proven code execution; patches are available for all affected platforms.

This is a genuinely lower-priority issue despite its 7.8 'High' CVSS base score, and multiple independent signals agree on that. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - critically, it is AV:L (local attack vector) with UI:R (user interaction required), meaning the elevated score is driven entirely by the C:H/I:H/A:H impact triad, not by remote reachability. However, the description only substantiates 'unexpected app termination' (an availability/denial-of-service outcome), so the vendor-assigned C:H/I:H appears to reflect the theoretical memory-corruption potential of an integer overflow (CWE-190) rather than demonstrated confidentiality or integrity loss. Corroborating the low real-world urgency: EPSS is only 0.17% (6th percentile), the vulnerability is NOT in CISA KEV, and CISA's SSVC decision framework records Exploitation: none and Automatable: no (only Technical Impact: total, which is consistent with a full app crash). There is no public exploit. In short, this is a high-CVSS-but-low-real-risk item: local vector, requires the victim to process an attacker-supplied file, no exploitation observed, and a patch is already shipped across all Apple platforms.

An attacker crafts a malicious texture file (e.g., embedded in a document, app asset, image, or 3D/graphics content) and delivers it to a victim, who opens or processes it on an unpatched Apple device. The integer overflow during texture parsing causes the processing application to terminate unexpectedly; no public exploit code is identified at time of analysis, and exploitation requires local file processing plus user interaction.