Apple iOS CVE-2026-86944

Exploitation requires the attacker to execute code locally on the device as an app - the CVSS PR:L and the description ('An app may be able to cause unexpected system termination') indicate a malicious or compromised application rather than a remote, unauthenticated attacker. There is no network vector (AV:L) and no user interaction required beyond running the offending app (UI:N). The impact is limited to availability (system crash/termination); the sources show no confidentiality or integrity impact and do not describe code execution. The exact triggering input or affected component is not described in the available sources. Limiting factors: the attacker must already be able to run code on the device, and fully patched systems (iOS/iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.7) are not affected.

This is a moderate-severity, low-urgency issue rather than a high-priority emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a locally-exploitable availability-only flaw: an attacker needs code already running on the device (a malicious or compromised app, hence PR:L), and the only impact is availability (A:H) - unexpected system termination - with no confidentiality or integrity impact. The signals are consistent and point to low real-world risk: EPSS is 0.15% (4th percentile), there is no CISA KEV listing (not actively exploited), and no public exploit or PoC reference is present in the input. The SSVC/priority decision label is 'this_month', which aligns with a patch-on-normal-cycle posture rather than act_now. One nuance worth noting: CWE-787 (out-of-bounds write) can in some cases be chained toward code execution, but the vendor-scored impact here is strictly availability (crash/DoS), and the available sources do not describe how the write is triggered, so no escalation beyond system termination should be assumed from this data.

A user installs a malicious or compromised app from outside the vetted distribution channel, or an attacker who has already achieved low-privilege code execution on the device runs crafted code. That code triggers the out-of-bounds write, causing the affected iOS/iPadOS or macOS system to unexpectedly terminate (a denial of service). No public exploit code or PoC reference is present in the input, and exploitation requires local app-level access rather than remote network reach.