Apple iOS CVE-2026-86885

Exploitation requires the attacker to be within radio range (CVSS AV:A) of an unpatched iOS/iPadOS device running a version below 27, with no authentication (PR:N) and no user interaction (UI:N) required - the user does not need to open a file, tap a link, accept a pairing request, or install anything. The relevant radio interface must be active on the victim device; if the radio subsystem carrying the malformed input is disabled, the attack path is removed. What limits exploitation: the vector is proximity-bound rather than internet-facing, so the attacker cannot reach remote targets; the impact is availability-only (system termination) with no data exfiltration or code execution demonstrated; and the specific radio subsystem is not named in the available advisory, meaning defenders cannot precisely state whether Wi-Fi, Bluetooth, or baseband traffic is the trigger. Repeated crashes/reboots may also serve as an observable indicator of an ongoing attempt.

The CVSS 3.1 score of 6.5 is driven entirely by the availability impact (A:H) with a reduced attack vector (AV:A) - the attacker must be within radio range, not on the global internet - and no privileges or user interaction are required (PR:N/UI:N), which makes opportunistic proximity attacks plausible in crowded physical spaces. However, the exploitation signals are weak: EPSS is 0.14% (4th percentile), which is very low and consistent with a non-weaponized, localized DoS rather than a mass-exploited issue; the vulnerability is NOT in CISA KEV and no public exploit code has been identified at time of analysis. Scope is unchanged (S:U) and confidentiality/integrity impacts are absent, so this is not a data-breach or code-execution risk. Real-world priority should be moderate: patch through normal update cadence rather than emergency response. Note the contrast that AV:A/PR:N/UI:N makes automation technically feasible for an attacker with radio hardware, even though no tooling is publicly known.

An attacker equipped with commodity radio hardware (e.g., a laptop with a wireless adapter) positions themselves within radio range of a target - such as in a café, conference, or transit hub - and transmits crafted input that the unpatched iOS/iPadOS device's radio-handling code fails to validate, causing the device to crash or abruptly restart. The attack requires no credentials and no user interaction, so it can be repeated opportunistically to disrupt a specific target's device availability. No public proof-of-concept or exploit code has been identified, so this scenario is inferred from the CVSS adjacent vector and the A:H/C:N/I:N impact profile.