Apple iOS CVE-2026-86892

Requires a malicious or compromised app to be installed and executing locally on an affected device (iOS/iPadOS before 26.7 or before 27, or visionOS before 27); the app abuses an OS interface that lacked proper entitlement enforcement to cause the DoS. Exploitation is LIMITED by: local-only access (AV:L, no remote/network path), the need to get an attacker-controlled app running on the device (PR:L), and impact confined to availability with no data exposure or code integrity loss. The exact feature/entitlement is not disclosed in Apple's advisory, so no more specific configuration prerequisite can be stated.

This is a low-to-moderate real-world priority despite a mid-range CVSS of 5.5. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms a local, availability-only impact: a malicious or compromised app already present on the device can trigger a denial-of-service, but there is no confidentiality or integrity impact and no remote reach. All signals point the same direction and are consistent: EPSS is very low (0.16%, 6th percentile), the issue is NOT on the CISA KEV list, and no public exploit code has been identified. Exploitation status is 'no public exploit identified at time of analysis.' The vendor (Apple) self-reported the flaw and shipped fixes, which is typical of proactively hardened iOS bugs rather than actively attacked ones. The root cause - missing entitlement checks (CWE-770, uncontrolled resource consumption) - means the fix simply added privilege gating. Net: a genuine bug worth patching via normal OS update cadence, but not an emergency; the local vector and PR:L requirement (attacker must get an app onto the device and running) substantially limit realistic risk. The Apple advisories (149034/149038/149041) are sparse and do not name the affected subsystem, so the specific triggering entitlement/feature cannot be independently confirmed.

An attacker publishes or sideloads a seemingly benign app that, once installed and run on an iPhone, iPad, or Vision Pro, invokes an OS interface it should not be entitled to use, exhausting a resource or crashing a system service to cause a denial-of-service. Because the attack vector is local (AV:L) with low privilege (PR:L) and no user interaction beyond running the app, the barrier is getting the app onto the device. No public proof-of-concept exists, and impact is limited to availability.