Apple iOS CVE-2026-84511

Exploitation requires the victim to process a maliciously crafted asset catalog - a compiled image/resource file parsed by Apple's asset-handling frameworks (e.g., CoreUI) when an app or the system loads bundled assets. This is a local vector (AV:L) with required user interaction (UI:R): the attacker must get the victim to open or load the malicious asset (via a downloaded/installed app, bundle, or file). No authentication or elevated privileges are needed (PR:N), but there is no remote/network-triggered path and no default-configuration remote exposure. Affected: all listed Apple OSes below the fixed versions (iOS/iPadOS <27, macOS <27/<15.8/<26.7, tvOS/visionOS/watchOS <27). Limiting factors: user interaction requirement, local-only vector, and observed impact confined to process termination.

This is a moderate-priority memory-corruption bug best treated as a client-side denial-of-service rather than a critical RCE. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8) is internally consistent - local vector, no privileges, but user interaction required - yet the C:H/I:H rating appears OVER-SCORED relative to the description, which states only that processing a crafted asset catalog 'may lead to unexpected process termination' (i.e., a crash/availability impact, with no confirmed confidentiality or integrity compromise or code execution). CWE-787 (out-of-bounds write) is the underlying mechanism and could in principle be leveraged further, but no such escalation is claimed by Apple. Corroborating signals point to LOW real-world exploitation urgency: EPSS is 0.20% (10th percentile), the CVE is not in CISA KEV, and no public exploit code is identified. Apple self-reported the issue (internal discovery), which typically indicates it was found through auditing/fuzzing rather than in-the-wild attacks. Net: patch through normal cycles; not an emergency. Key discrepancy to note - vendor C:H/I:H conflicts with a description that supports only availability impact; verify with Apple's advisory pages before treating this as a confidentiality/integrity risk.

An attacker crafts a malicious asset catalog (a compiled image/resource file such as a .car/Assets bundle) and delivers it to a victim inside an app, document, or downloaded bundle. When the victim's device processes/renders the crafted asset catalog, the out-of-bounds write triggers and the handling process terminates unexpectedly (crash/DoS). No public exploit code is identified, and exploitation requires user interaction to open or load the malicious asset.