iOS and iPadOS EUVD-2026-104736

Exploitation requires the attacker to already occupy a 'privileged network position' - an active on-path/man-in-the-middle foothold on the traffic path to the target device - per the vendor description; this is the primary limiting factor and is reflected by AC:H. No authentication is needed (PR:N) and no user interaction is required (UI:N), but the on-path precondition means this cannot be launched by an arbitrary remote Internet attacker against a device behind normal network boundaries. Affected deployments are iOS/iPadOS versions before 26.7 (26.x line) and before 27; devices updated to iOS/iPadOS 26.7 or 27 are not exploitable. Impact is limited to availability (DoS) with no data exposure or code execution.

This is a moderate-severity denial-of-service flaw (CVSS 5.9, availability-only impact: C:N/I:N/A:H) whose real-world exploitability is meaningfully constrained. The CVSS vector itself tempers the score: although AV:N makes it network-reachable and PR:N/UI:N require no authentication or user interaction, AC:H reflects the hard precondition stated in the description - the attacker must already hold a 'privileged network position' (i.e., an active man-in-the-middle or on-path foothold), which is not trivially obtained. All exploitation signals point the same direction and reinforce the low-urgency read: CISA SSVC lists Exploitation as 'none', Automatable 'no', and Technical Impact 'partial'; there is no CISA KEV listing and no public exploit identified; no EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are therefore consistent rather than conflicting - a high-reach but availability-only bug gated behind an on-path precondition. Net: this is a patch-in-normal-cycle issue, not an emergency, despite affecting an enormous install base. One data caveat: the input Tags label this 'Information Disclosure', which contradicts the description and the CVSS impact metrics (no confidentiality impact; it is a pure DoS) - treat the tag as erroneous.

An attacker who has already achieved a privileged on-path/man-in-the-middle position on the network between a victim iPhone or iPad and its destination injects or manipulates malformed traffic that the OS fails to validate correctly (CWE-20). The crafted input triggers the denial-of-service condition, disrupting availability of the affected service or device function. No public exploit code or active exploitation has been identified, and the attack is non-trivial given the required network position (AC:H).