Apple iOS CVE-2026-86918

Exploitation requires the target to process (open, preview, or render) an attacker-supplied maliciously crafted image using the affected Apple image-handling code on iOS/iPadOS, macOS, tvOS, visionOS, or watchOS prior to version 27. The key LIMITING factor is required user interaction (CVSS UI:R): the victim must receive and trigger processing of the malicious image; there is no server-side or zero-click prerequisite stated. No special non-default configuration or authentication is needed, but the impact is limited to application termination (availability only, A:L) - there is no confidentiality or integrity impact and no indication of arbitrary code execution. Risk is further bounded on fully patched (version 27) devices, which are not affected.

All signals converge on LOW real-world priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, base 4.3 Medium) shows the only impact is availability (A:L) - there is no confidentiality or integrity loss - and the outcome per the description is merely 'unexpected app termination' (a crash/DoS), not code execution, despite the CWE-787 out-of-bounds write. User interaction is required (UI:R: a victim must process the malicious image). The exploitation signals reinforce low urgency and are mutually consistent rather than conflicting: EPSS is 0.15% (4th percentile), CISA SSVC rates Exploitation='none', Automatable='no', and Technical Impact='partial', there is no CISA KEV listing, and no public exploit was identified. Note one nuance to verify: while AV:N labels this network-reachable, exploitation realistically depends on delivering an image and getting the target to open/process it, so the practical vector is closer to a user-driven file open than a fully remote unauthenticated server exploit. Bottom line: a patch-on-normal-cycle issue, not an emergency.

An attacker crafts a malformed image file and delivers it to a victim via message, email, web page, or app content; when the victim's Apple device processes the image, the out-of-bounds write corrupts memory and the handling application terminates unexpectedly (a denial-of-service crash). No public exploit code was identified at time of analysis, and the CVSS vector indicates only availability impact with no code execution or data exposure. Attack complexity is low but the attack requires user interaction to process the image.