Apple iOS CVE-2026-84507

Exploitation requires the attacker to already run code as an app on the target Apple device (AV:L, PR:L per the vendor vector) and to reliably win a kernel race condition - a timing-dependent condition that limits determinism and typically demands many attempts. No network vector, no user interaction beyond having the malicious app execute (UI:N). There is no special product feature or non-default configuration prerequisite; any default-configured affected build (iOS/iPadOS <26.7 and <27, macOS <15.8/<26.7/<27, tvOS/visionOS/watchOS <27) running the attacker's app is exposed. The principal limiting factors are the local-code-execution precondition and the inherent unreliability of race-window timing, which together make opportunistic mass exploitation impractical.

This is a locally-exploitable kernel-level flaw, not a remote one: the vendor CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High) is consistent with the description - a local app (PR:L) triggers a race condition (CWE-362) that either terminates the system or corrupts kernel memory. Real-world risk signals are mild-to-moderate: EPSS is only 0.18% (8th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, indicating no evidence of active or imminent exploitation. The main severity driver is the full C:H/I:H/A:H triad Apple assigns to kernel memory corruption, which is defensible because kernel corruption primitives can be escalated toward code execution - but the AC:L rating is optimistic for a race condition, which typically requires precise timing and multiple attempts to win reliably; a realistic assessment leans toward AC:H. The 'Information Disclosure' tag conflicts with the description, which cites only system termination and kernel memory corruption (integrity/availability), not confidentiality leakage. Overall this is a patch-in-normal-cycle issue: dangerous by kernel-corruption category but gated behind local code execution with low observed exploitation interest, not an emergency.

A user installs or is tricked into running a malicious or compromised app on an Apple device; the app repeatedly exercises a timing-sensitive kernel code path to win a race condition. Success corrupts kernel memory - crashing the device (DoS) or, with further effort, establishing a memory-corruption primitive that a skilled attacker could chain toward privilege escalation. No public exploit code is known, and exploitation requires local code execution plus reliable race-window timing.