Apple iOS/iPadOS EUVD-2026-110142

Exploitation requires a malicious or compromised app to run on the affected Apple device and reach the vulnerable code path; the description states 'An app may be able to cause unexpected system termination or corrupt process memory' but does not name the specific feature, API, or configuration that triggers the out-of-bounds write. Limiting factors: the attacker must first get an app onto the device (subject to App Store review and the iOS/iPadOS/visionOS app sandbox), and the confirmed outcome is process/system crash or memory corruption rather than demonstrated code execution or sandbox escape. The vendor CVSS claims a network vector (AV:N) with user interaction (UI:R), but the app-based description points to local execution - verify the actual reachability with Apple before treating this as remotely exploitable. Affected: iOS/iPadOS before 26.7.2 and before 27.2, and visionOS before 27.2.

This is a moderate-severity memory-safety flaw (CWE-787 out-of-bounds write) that in practice is a lower real-world priority than its 6.5 score might suggest. The signals are internally consistent on the low side: EPSS is 0.55% (46th percentile), SSVC reports Exploitation=none / Automatable=no / Technical Impact=partial, there is no CISA KEV listing and no public exploit or PoC reference in the provided data - exploitation status is therefore 'no public exploit identified at time of analysis.' The vendor-supplied CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) conflicts with the description: the description states 'An app may be able to cause unexpected system termination or corrupt process memory,' which describes a locally installed app triggering the bug, not a network-reachable attack - the AV:N rating should be treated with caution and is more realistically a local (AV:L) condition. Impact is confined to availability/memory integrity (C:N/I:N/A:H); there is no confirmed code-execution, data-disclosure, or sandbox-escape claim in the evidence. The vuln.today Decision label is 'this_month,' consistent with a patch-on-normal-cadence item rather than an emergency. Net: genuine but not urgent - schedule the update within the normal monthly cycle.

A user installs a malicious or compromised app that invokes the vulnerable code path, triggering an out-of-bounds write that corrupts process memory and crashes the process or the system. No public exploit or PoC is identified in the provided data, and the exact triggering API or feature is not described in the available sources. Realistic impact per the evidence is denial of service / memory corruption, not confirmed code execution.