Apple iOS CVE-2026-86913

Exploitation requires the victim to open or have the system process a maliciously crafted media file (UI:R) in an affected Apple media-handling component across iOS/iPadOS/macOS/tvOS/visionOS/watchOS; it does not require authentication or elevated privileges (PR:N). The primary limiting factors are the mandatory user/system interaction to process the attacker's file and the constrained impact - the documented outcome is application termination or process-memory corruption, not confirmed code execution or data disclosure. Affected versions are those below the fixed builds (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8 / Tahoe 26.7 / 'Golden Gate' 27, tvOS 27, visionOS 27, watchOS 27); systems already updated to these builds are not exposed.

This is a moderate-severity memory-safety flaw (CVE-2026-86913, CWE-416 use-after-free) with multiple signals pointing to LOW real-world urgency despite its broad platform reach. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, base 5.4) describes an unauthenticated, low-complexity attack that nonetheless REQUIRES user interaction and yields only partial integrity and availability impact - no confidentiality loss and no code-execution guarantee (the described outcome is 'unexpected app termination or corrupt process memory,' i.e. a crash/DoS rather than confirmed RCE). All exploitation-pressure signals agree and reinforce each other: CISA SSVC rates Exploitation=none, Automatable=no, Technical Impact=partial; EPSS is 0.17% (6th percentile), among the lowest tiers; the CVE is NOT on the CISA KEV list; and no public exploit or POC is referenced. There is no conflict between the signals here - low EPSS, no KEV, and SSVC 'none' are mutually consistent. The one caveat is interpretive, not contradictory: the description phrase 'corrupt process memory' leaves open the theoretical possibility of memory-corruption primitives being developed into something more impactful, but the vendor scored C:N and only I:L/A:L, so the current evidence supports DoS-class impact, not disclosure or takeover. Net: a real patch-worthy issue given the ubiquity of Apple platforms, but a routine-patch priority rather than an emergency.

An attacker crafts a malicious media file and delivers it to a victim via a webpage, message attachment, email, or shared file; when the user opens or the OS auto-processes the media, the use-after-free is triggered in the media-handling code, crashing the application or corrupting its process memory. Because user interaction is required (UI:R) and no public exploit or POC is referenced, realistic use would be opportunistic social-engineering delivery; the documented impact is app termination or memory corruption rather than confirmed arbitrary code execution.