Apple iOS CVE-2026-65415

The attacker must be a local user able to execute code or run an application on the target device; the CVSS vector's UI:R implies the user must also interact (for example opening an attacker-supplied app), and the description's 'local user' wording confirms this is not a remote pre-auth vector despite the AV:N in the supplied score. Successful exploitation additionally requires winning a narrow concurrent-execution race window, which is non-deterministic and often crashes the target first. Relevant limits: no unauthenticated/remote path is described, kernel memory readability and system termination are the only demonstrated impacts (no code execution or persistence claimed), the device may visibly panic, and no public exploit code exists at time of analysis.

Signals conflict and should be treated carefully. NVD's CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R (8.1), which describes a remote, low-complexity, unauthenticated attack requiring user interaction - yet the vendor description explicitly states 'a local user may be able to cause unexpected system termination or read kernel memory', implying AV:L/AC:H/PR:L. That mismatch is unresolved in the supplied data and should be verified against Apple's advisory before treating this as a remotely reachable flaw. EPSS is very low (0.16%, 6th percentile) and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: partial, with no KEV listing and no public exploit code - so despite the elevated base score, this reads as a low-priority hardening item rather than an imminent threat. Realistically it is a kernel memory-disclosure/DoS primitive useful inside a chained local exploit, not a standalone mass-exploitation vector. The absence of POC and KEV data is itself a limiting factor on the accuracy of this assessment.

An attacker who already has code execution on the device - for example a malicious app installed by a user, or a post-compromise payload - repeatedly drives the vulnerable kernel code path concurrently to win the race window, either leaking kernel memory to defeat kernel ASLR or crashing the device. Because the race is timing-dependent, exploitation is unreliable and typically embedded as one primitive in a larger local privilege-escalation or sandbox-escape chain rather than used on its own. No public exploit code has been identified.