Apple operating systems CVE-2026-86953

Exploitation requires the attacker to be in physical proximity to the target device (CVSS AV:P), consistent with Apple's statement that 'an attacker in physical proximity may be able to cause a denial-of-service.' No authentication is required (PR:N) and no user interaction is needed (UI:N), but the physical-proximity constraint is the dominant limiting factor - this cannot be exploited remotely over a network, which sharply reduces realistic attack surface. Impact is limited to denial-of-service (A:H only); there is no code execution, data disclosure, or integrity loss. Mitigation is straightforward: updating to the fixed OS versions (all v27) removes the flaw, and the affected version range is everything prior to 27.

This is a genuinely low-priority issue despite the CRITICAL-sounding CWE-787 (out-of-bounds write) classification. The CVSS 3.1 base score of 4.6 (MEDIUM) is driven down by the Physical attack vector (AV:P) - the attacker must be in physical proximity to the target device - and the impact is limited strictly to availability (C:N/I:N/A:H), meaning a denial-of-service only, with no confidentiality or integrity loss. All exploitation signals point the same way and are consistent: CISA SSVC reports Exploitation: none, Automatable: no, and Technical Impact: partial, which aligns with a DoS-only outcome. There is no CISA KEV listing, no public POC, and no EPSS score was provided in the input, so there is no evidence of active or likely near-term exploitation. The signals do not conflict: a physical-proximity DoS on a patched Apple OS is not a widespread remote threat. The primary risk driver here is the enormous install base of Apple's operating systems rather than the severity or exploitability of the flaw itself.

An attacker within physical radio/proximity range of a victim's iPhone, iPad, Mac, Apple TV, Apple Watch, or Vision Pro sends crafted data that triggers an out-of-bounds write, corrupting memory and crashing the affected service or device (denial-of-service). No public exploit code has been identified, and the physical-proximity requirement means the attacker must be physically near the target rather than operating remotely over the internet.