iOS and iPadOS CVE-2026-84530

Requires the attacker to already run code inside an app on the target Apple device (local, low-privilege sandboxed app context, PR:L) - there is no remote or unauthenticated vector. No user interaction beyond running the malicious app is needed (UI:N). Exploitation is limited by Apple's app-distribution controls (App Store review / notarization / sideloading restrictions) that gate getting a malicious app onto the device, and by the fact that the outcome is a bounded confidentiality leak (C:L) with no code execution or privilege gain by itself. Applies to iOS/iPadOS before 26.7 and before 27, macOS Tahoe before 26.7 and Golden Gate before 27, and tvOS/visionOS/watchOS before 27; devices already updated to the fixed builds are not exposed.

This is a genuinely LOW-priority issue despite being a kernel-memory disclosure, and all signals agree. The CVSS 3.1 base score is only 3.3 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - local attack vector, requiring a low-privilege app already running on the device, yielding only limited confidentiality impact (C:L) and no integrity or availability effect. EPSS reinforces this: 0.20% probability (10th percentile), placing it well below any exploitation-likelihood threshold. There is no CISA KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - there is no CVSS-says-network-but-description-says-local conflict here; the description ('An app may be able to disclose kernel memory') aligns cleanly with the AV:L/PR:L vector. The only realistic value of this bug to an attacker is as an information-leak primitive (e.g., defeating KASLR) chained with a separate exploit; standalone it is not a priority. Patch is available from Apple across all affected OSes.

A user installs a malicious or compromised app from an untrusted source (or an attacker who already has code execution in a low-privilege app context). The app invokes the vulnerable kernel path to read residual/uninitialized kernel memory, harvesting fragments such as pointers or secrets that could weaken kernel address-space layout randomization. No public exploit code exists, and the leak alone grants no elevated control - its practical use is as a stepping stone in a larger exploit chain.