Apple iOS CVE-2026-86957

Exploitation requires the attacker to be within wireless/radio proximity of the target device (CVSS AV:A, adjacent - not routable over the internet); the vulnerable wireless-stack code path that performs the out-of-bounds read must be reachable, which is the case on default configurations of affected Apple OS versions (iOS/iPadOS before 26.7 and before 27, macOS before 15.8/26.7/27, tvOS/visionOS/watchOS before 27). No authentication (PR:N) and no user interaction (UI:N) are needed. The key LIMITING factors are the mandatory physical proximity (prevents remote or automated mass exploitation - SSVC Automatable=no) and the impact ceiling of availability only (device crash/reboot), with no confidentiality or integrity effect.

Signals are consistent and point to a moderate, availability-only risk. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) describes an unauthenticated, low-complexity attack over an adjacent/wireless channel whose only impact is availability (system termination) - no confidentiality or integrity loss. CISA's SSVC framework agrees and tempers the urgency: Exploitation=none (no observed or public exploitation), Automatable=no (proximity requirement prevents mass/wormable abuse), Technical Impact=partial. The CVE is NOT in CISA KEV and no POC is indicated, so there is no public exploit identified at time of analysis. The practical ceiling is a denial-of-service/crash of a device within radio range, not remote code execution or data theft. Note a data tension: the input Tags include 'Information Disclosure' and 'Buffer Overflow', but the authoritative CVSS vector sets C:N/I:N and the description states only 'unexpected system termination' - treat this as a DoS-only out-of-bounds read, not an info-leak, unless the vendor states otherwise. Net: a real but low-priority patch-management item (crash of Apple devices by an attacker in physical proximity), not a high-urgency, internet-exploitable threat.

An attacker within wireless/radio proximity of a target Apple device (e.g., the same Wi-Fi/Bluetooth/AWDL range in a public space) transmits malformed wireless frames that trigger an out-of-bounds read in the vulnerable parsing code. The low attack complexity and lack of required authentication or user interaction (AV:A/AC:L/PR:N/UI:N) make the crash reliable once in range, but the adjacent-only vector means the attacker must be physically nearby. No public exploit is identified at time of analysis.