iOS and iPadOS CVE-2026-65367

Exploitation requires a malicious or crafted application to be installed and executed on the target device with at minimum a low-privilege user context (consistent with CVSS PR:L). The attack vector is local (AV:L), meaning the app must run on the device itself - remote unauthenticated exploitation is not possible. No special iOS configuration, entitlement, or enabled feature is identified as a prerequisite beyond standard app execution. Factors that limit exploitation: the attacker must get the target user to install the application (App Store review, MDM restrictions, or user sideloading gatekeeping all act as friction); the impact is limited to device availability (crash/reboot) with no data exfiltration or persistence; and the attack is rated not automatable by SSVC, meaning mass exploitation campaigns are unlikely.

The composite risk picture is consistently low-to-moderate. CVSS 3.1 scores this at 5.5 (Medium) with a local attack vector (AV:L), low complexity (AC:L), low privilege requirement (PR:L), and availability-only impact (A:H, C:N, I:N) - meaning exploitation causes a crash but no data exposure or integrity compromise. EPSS at 0.10% (1st percentile) signals near-negligible observed or predicted exploitation activity. SSVC corroborates: exploitation is rated 'none,' the attack is not automatable, and technical impact is only 'partial.' There is no KEV listing and no public proof-of-concept. The primary real-world risk is a malicious or buggy app causing a denial-of-service condition (device reboot), which, while disruptive, is fully self-contained and leaves no persistent compromise. No CVSS/description conflict is detected - local vector is consistent with an app-level trigger. Overall: genuine but low-urgency patching candidate; not a priority for emergency deployment windows.

An attacker distributes a malicious app (or trojanizes a legitimate app) that, when executed on a vulnerable iPhone or iPad, submits crafted input designed to produce a null pointer in a system-level API handler. The null dereference causes the affected system process to crash, triggering an unexpected device reboot. No public proof-of-concept exploit exists at time of analysis, and the local execution requirement limits this to scenarios where the attacker can induce the target to install and run the malicious application.