Apple iOS EUVD-2026-29252

Exploitation requires the attacker to run code as an installed application on the target Apple device - a local app context is the prerequisite, despite the CVSS AV:N rating, because the description explicitly states 'An app may be able to determine kernel memory layout.' No special non-default configuration is required and no user interaction is needed once the app is running, but the attacker must first achieve app installation through the App Store, TestFlight, enterprise provisioning, sideloading (where permitted), or macOS package distribution, and the device must be running a pre-patch version of iOS/iPadOS, macOS, tvOS, or watchOS as listed in the affected versions. The leaked information alone yields kernel memory layout disclosure (KASLR bypass) and not direct code execution, so practical impact is limited unless paired with a separate memory-corruption vulnerability.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields 7.5, but the network attack vector is misaligned with the description, which clearly states 'An app may be able to' - implying a local, installed application is required; defenders should treat this as a local information-disclosure issue despite the AV:N rating. EPSS is 0.02% (7th percentile) and SSVC reports Exploitation:none with Technical Impact:partial, consistent with a primitive that is useful only as part of a chain, not as a standalone compromise. There is no CISA KEV listing and no public PoC identified, so real-world urgency is moderate - important for high-value mobile targets and jailbreak/exploit-chain research, lower priority for general enterprise fleets behind MDM patch policies. Note the discrepancy between the CVSS network vector and the description's app-based exploitation model - this should be verified against Apple's advisory before relying on AV:N for prioritization.

An attacker convinces a target to install a malicious or trojanized app from the App Store, TestFlight, an enterprise distribution channel, or via sideloading on macOS. The app queries the affected log surface to harvest unredacted kernel pointers, computes the KASLR slide, and feeds the resulting addresses into a second memory-corruption exploit to achieve reliable kernel code execution or sandbox escape. No public PoC has been identified, but information-disclosure primitives of this class are routinely integrated into commercial mobile exploit chains.