Apple iOS, iPadOS, macOS, tvOS EUVD-2026-29279

Attack requires attacker presence on the same local network segment as the target device. The attacker must be able to send network traffic to the device (not blocked by local firewall rules). The vulnerability is triggered by unauthenticated, locally-sourced input; no credentials or special device configuration is required. Importantly, the local network requirement (AV:L in CVSS vector) means remote exploitation across the internet is not possible - attackers must have direct Layer 2/3 adjacency or compromised local network presence. Default configurations of affected Apple devices are vulnerable; no special settings enable or disable this attack surface.

Risk assessment reveals a significant disconnect between CVSS and real-world exploitation probability. CVSS score of 6.2 (Medium) reflects local attack vector (AV:L) with no privileges required (PR:N), no user interaction (UI:N), and high availability impact (A:H). However, EPSS score of 0.02% (percentile 4%) indicates very low exploitation probability, suggesting this is a low-priority vulnerability in practice. The local attack vector requirement substantially limits scope compared to network-based DoS attacks. No evidence of active exploitation (KEV status not indicated), no public exploit code identified, and low EPSS percentile together suggest this remains a theoretical rather than operational risk despite vendor patching. The high CVSS availability rating is proportionate to the technical impact (service crash), but the local network prerequisite substantially reduces attack surface in typical environments. For most organizations, this represents a lower priority than network-exploitable DoS vulnerabilities despite the published CVSS score.

An attacker positioned on the same local network segment as a vulnerable Apple device crafts and sends a specially designed local network packet or request that fails validation checks. The malformed input reaches code that attempts to dereference a null pointer, causing the affected service or system component to crash, rendering the device temporarily unavailable. The attack requires no user interaction and can be repeated to sustain denial of service.