Apple iOS and iPadOS CVE-2026-86975

Exploitation requires the attacker to get a maliciously crafted image file parsed by the target's Apple OS image-handling code (e.g., ImageIO/system image decoders invoked when viewing an image in a browser, message, email, or app). The primary limiting factor is required user interaction (CVSS UI:R): the victim must open, preview, or otherwise cause the device to process the attacker-supplied image - it is not fully automatic or wormable (SSVC Automatable: no). No authentication is required (PR:N) and no special non-default configuration is needed, but the impact is bounded to unexpected process termination (A:L, C:N, I:N) - i.e., an application/process crash rather than code execution or information disclosure. Affected versions are all releases prior to 27 across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS; devices updated to the 27 train are not affected.

This is a genuinely low-priority issue despite being network-reachable. The signals are largely consistent and all point toward low real-world risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) yields only 4.3 (Medium), and critically the only impact is availability (A:L) with no confidentiality or integrity impact - the vulnerability causes unexpected process termination, not code execution or data disclosure. CISA's SSVC framework corroborates this: Exploitation is 'none' (no observed exploitation), Automatable is 'no' (requires user interaction to deliver/process a crafted image), and Technical Impact is only 'partial.' There is no CISA KEV listing and no public exploit identified, so this is not actively exploited. No EPSS score was supplied in the input, so exploitation-probability modeling cannot be factored in - this is a data gap, not evidence of either high or low likelihood. The one mild tension worth noting is that the tags label this 'Information Disclosure,' yet the CVSS vector explicitly sets C:N - an out-of-bounds READ that merely crashes the process does not necessarily leak data, so the practical impact is denial of service (app/process crash), not disclosure. Net assessment: a high-ubiquity product (Apple OSes) raises exposure, but the DoS-only impact, required user interaction, and absence of exploitation signals make this a routine patch-in-normal-cycle item rather than an emergency.

An attacker crafts a malformed image and delivers it through a web page, email, iMessage, or other channel where the victim's Apple device will parse it; when the image is processed the out-of-bounds read triggers and the handling process terminates unexpectedly, producing a denial of service. No public exploit code has been identified, and the impact is limited to a crash rather than code execution or data theft.