iOS and iPadOS EUVD-2026-29270

Attacker must have privileged network position (PR:H) between victim device and network service-this is the critical gating factor. No special product configuration, feature flags, or non-default settings are implied by the description. Exploitation requires the attacker to be on the network path (e.g., compromised Wi-Fi router, ISP infrastructure, network core router, or BGP-level network hijacking). Devices running iOS/iPadOS versions prior to 18.7.7 or 26.4 are vulnerable; patched versions are not affected. This is NOT remote unauthenticated exploitation from arbitrary internet locations; it requires network-layer attacker privilege and positioning.

Risk is LOW in real-world scenarios despite the network attack vector. CVSS vector shows AV:N/AC:L but is heavily mitigated by PR:H, limiting attackers to those with high network-layer privilege. EPSS score of 0.02% (5th percentile) strongly indicates minimal real-world exploitation probability and suggests this is not a priority target for opportunistic threat actors. No KEV (CISA Known Exploited Vulnerabilities) status confirmed, and no public exploit code identified in input data. Attack complexity is low (AC:L), but the privilege requirement acts as a hard gate for most attack scenarios. This appears to be a low-priority patch unless the organization operates in high-risk network environments where ISP or upstream network compromise is a credible threat model.

An attacker with control of a network intermediary (e.g., rogue Wi-Fi access point, compromised ISP upstream, BGP hijacking) crafts and injects malformed network packets targeting iOS/iPadOS devices. The unvalidated input triggers excessive resource consumption in the receiving device's network stack, causing it to become unresponsive or reboot. Multiple devices on the network can be targeted simultaneously to amplify the denial-of-service impact.