Apple iOS and macOS EUVD-2026-110229

Exploitation requires that an application on an affected Apple OS process an attacker-supplied, maliciously crafted image; per the CVSS vector it is network-reachable and unauthenticated (PR:N) but REQUIRES user interaction (UI:R), meaning the victim must open or otherwise cause the image to be processed - it is not a zero-click remote attack on default configurations. The impact is limited to unexpected app termination (availability only); there is no indication in the sources of code execution, data disclosure, or integrity loss. Limiting factors for defenders: the dependency on user interaction, the absence of any confidentiality/integrity impact, no known active exploitation (SSVC Exploitation: none, no KEV), and vulnerability only on versions below the fixed builds listed above.

This is a moderate-severity memory-corruption flaw (CWE-787 out-of-bounds write) in Apple's image-processing code across iOS/iPadOS and macOS, carrying a CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). The signals are internally consistent and point AWAY from an urgent, widespread threat: the only impact is availability (A:H - unexpected app termination / crash), with no confidentiality or integrity loss, and successful attack requires user interaction (UI:R). Corroborating this, EPSS is low (0.50%, 42nd percentile), SSVC records Exploitation: none, Automatable: no, Technical Impact: partial, there is no CISA KEV listing, and no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with the data. The one caveat worth noting is that an out-of-bounds WRITE often has code-execution potential, yet Apple's own description and the CVSS impact scope it strictly to 'unexpected app termination' (a crash/DoS), so on current evidence this should be treated as an availability issue, not RCE - if a vendor update later reclassifies impact, reassess. Overall this is a legitimate but non-emergency patch-this-cycle item, not a high-CVSS-but-low-real-risk false alarm nor a drop-everything incident.

An attacker crafts a malicious image and delivers it to a victim (for example via a website, message, or email attachment) such that the Apple OS image-processing code parses it; because exploitation requires the user to process the image (UI:R), the attacker must induce that action. When the malformed image is processed, the out-of-bounds write corrupts memory and causes the handling application to terminate unexpectedly (denial of service). No public exploit is identified at time of analysis, and the specific trigger within the parser is not described in the available sources.