Apple iOS/iPadOS EUVD-2026-110250

Exploitation requires the attacker to already be executing code as an app on the target Apple device (AV:L, PR:L): there is no remote or network trigger and no user interaction is needed once the app runs (UI:N). The app must reach the affected kernel-interfacing code path to trigger the use-after-free and gain kernel-level code execution. Limiting factors: an attacker must first deliver and run an app (e.g., malicious App Store/sideloaded app or a prior content-execution stage), and the device must be unpatched - specifically older than iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Golden Gate 27, or macOS Tahoe 26.7.2. The specific app entitlement, sandbox state, or configuration needed to reach the flaw is not described in the available Apple sources.

Signals here point to a serious-but-not-emergency local privilege escalation rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C/I/A all High) describes a local, low-complexity flaw requiring a low-privileged foothold (an already-running app) with no user interaction, yielding total compromise via kernel code execution - consistent with CWE-416 use-after-free. SSVC reinforces this: Technical Impact is 'total' but Exploitation is 'none' and Automatable is 'no', meaning high per-target impact without scalable, worm-like exploitation. EPSS is low at 0.20% (10th percentile), KEV status is not present (no CISA listing), and no POC or exploit reference is supplied, so there is currently no evidence of exploitation or public tooling. The vuln.today decision label is 'this_week', indicating prompt patching is warranted given the kernel-level impact and ubiquitous platform, but not an active-incident emergency. No signals are directly conflicting; the low EPSS and SSVC 'none' are consistent with a newly disclosed, vendor-reported (Apple) issue with no observed attacks. Key limitation: Apple's advisory text is terse and does not describe the trigger, affected component, or whether a sandboxed app suffices, so the real-world attacker precondition (what 'an app' must already achieve) is inferred from the CVSS PR:L rather than stated.

A malicious or compromised application already present on an iOS/iPadOS/macOS device triggers a use-after-free in kernel-handled memory, corrupting kernel state to execute arbitrary code at kernel privilege and escape the app sandbox for full device compromise. This is a local escalation from an app context (AV:L, PR:L, UI:N), making it a likely second stage after an attacker lands a low-privilege app (e.g., via a malicious app or a browser/content exploit). No public exploit identified at time of analysis, and the precise trigger is not described in the available sources.