Apple iOS EUVD-2026-104719

Exploitation requires that the attacker control a Bluetooth device that is ALREADY PAIRED with the target (per Apple's description 'an attacker with a paired Bluetooth device'), and the attacker must be within Bluetooth radio range (CVSS AV:A, adjacent). No user interaction (UI:N) and no account-level privileges (PR:N) are needed once pairing exists, but the prior-pairing requirement is the primary limiting factor: an attacker cannot exploit a victim with whom no Bluetooth pairing has been established, which rules out purely remote/internet-based and untargeted mass exploitation (consistent with SSVC Automatable: no). Affected deployments are default configurations of iOS/iPadOS <26.7 and <27, macOS Sequoia <15.8, macOS Tahoe <26.7, macOS Golden Gate <27, and visionOS <27 with Bluetooth enabled.

Signals are consistent and point to a serious-but-constrained issue rather than an urgent mass-exploitation threat. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.8) reflects low-complexity, no-interaction code execution with full confidentiality/integrity/availability impact over an adjacent (Bluetooth) channel - SSVC agrees on Technical Impact: total. However, SSVC Exploitation is 'none' and the issue is NOT on CISA KEV, so there is no confirmed active exploitation and no public exploit identified at time of analysis. EPSS is low at 0.19% (8th percentile), and SSVC Automatable: 'no' - the adjacency requirement plus the need for a paired Bluetooth device makes this non-wormable and unsuitable for untargeted mass scanning. The key tension: AV:A with PR:N scores as 'unauthenticated adjacent,' yet the description explicitly requires 'a paired Bluetooth device,' which is a meaningful real-world precondition not fully captured by PR:N - the attacker must already have an established Bluetooth pairing/proximity to the victim. Net: a genuinely high-impact RCE on an enormous install base, but low immediate exploitation likelihood; prioritize patching for high-value/mobile targets, but this is not a drop-everything internet-facing emergency.

An attacker within Bluetooth range who controls a device already paired with the victim's iPhone, iPad, Mac, or Vision Pro sends a malicious Bluetooth protocol message that overflows a fixed-size stack buffer in the parsing code. With no user interaction required, the overflow corrupts stack memory and achieves arbitrary code execution on the target device. No public exploit code has been identified at time of analysis, and the attack requires prior pairing and physical proximity.