Apple iOS and iPadOS EUVD-2026-104708

Exploitation requires the attacker to be within wireless radio range of the target device (CVSS AV:A), implying a shared or adjacent radio link rather than internet-based access. No authentication is required (PR:N) and no user interaction is needed (UI:N), and the issue affects default configurations of the listed Apple operating systems. The primary limiting factors are: (1) physical proximity - the attacker cannot reach the target over the internet; (2) the impact is restricted to a crash/system termination (A:H, C:N, I:N), so there is no code execution or data access; and (3) the target must be running an unpatched version (below iOS/iPadOS 26.7 or 27, macOS 15.8/26.7/27, or the 27-series of tvOS/visionOS/watchOS). The specific radio feature or protocol that must be reachable is not disclosed in the advisory.

This is a moderate-severity denial-of-service issue, not a high-priority emergency, and the multiple intelligence signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) shows an adjacent-network ('radio range') attack with no privileges or user interaction, but the impact is confined to availability only (A:H) - the description's 'unexpected system termination' matches C:N/I:N, so there is no indication of code execution, data exposure, or integrity loss. CISA SSVC reinforces a low-urgency posture: Exploitation=none, Automatable=no, Technical Impact=partial, which aligns with the very low EPSS of 0.18% (7th percentile). The vulnerability is NOT on the CISA KEV list and no public exploit code was identified, so there is no evidence of active or impending mass exploitation. The one factor that raises this above pure background noise is the ubiquity of affected Apple platforms and the zero-interaction/zero-auth adjacency vector, which makes it a plausible proximity nuisance/DoS primitive; however, as a crash-only bug against targets the attacker must already be in radio range of, real-world risk is limited and targeted rather than widespread. Treat this as routine patch-cycle priority, not out-of-band.

An attacker within wireless/radio range of a victim Apple device sends crafted radio-layer traffic that triggers an out-of-bounds write (CWE-787) in the affected component, corrupting memory and forcing an unexpected system termination (crash/reboot). Because the CVSS vector is AV:A/AC:L/PR:N/UI:N, no pairing, authentication, or user action is required - only physical proximity. No public exploit code was identified at time of analysis, and the realistic outcome is a denial of service rather than device takeover.