Apple OS EUVD-2026-29301

Requires installation and execution of a malicious or compromised application on the target Apple device. The vulnerability is NOT exploitable remotely over the network despite the CVSS AV:N rating - the description clearly states 'an app may be able to' which mandates local app presence. Exploitation requires no user interaction beyond initial app launch (UI:N) and no authentication to the app itself (PR:N within the app context). The primary limiting factor is Apple's App Store review process for consumer devices and enterprise application signing requirements for managed devices. Devices with jailbreaks, developer mode enabled, or permissive MDM policies allowing arbitrary app installation face higher risk. Default configurations of consumer iOS/iPadOS devices with App Store-only installation are significantly protected, while macOS systems allowing broader app sources and enterprise-managed devices have elevated exposure.

Risk assessment reveals conflicting signals requiring nuanced interpretation. The CVSS 7.3 (High) with vector AV:N/AC:L/PR:N/UI:N suggests network-based unauthenticated exploitation, yet the description explicitly states 'an app may be able to' which indicates LOCAL attack vector requiring prior application installation - a direct contradiction with the AV:N metric. The correct interpretation is local exploitation (malicious app required), making the CVSS vector potentially misclassified. EPSS score of 0.02% (5th percentile) confirms extremely low real-world exploitation probability, with no public exploit code identified and no CISA KEV listing. The impact is split: kernel memory read enables information disclosure (C:L) potentially useful for exploit chain development, while system termination provides denial-of-service (A:L). The I:L rating is unclear given the described impacts. Real-world risk is LOW-MEDIUM for consumer devices with App Store protections limiting malicious app distribution, but MEDIUM-HIGH for enterprise MDM environments or jailbroken devices where arbitrary apps may execute. Priority should align with whether your environment controls application installation sources rather than raw CVSS score.

An attacker distributes a malicious application through enterprise MDM provisioning, third-party app stores, or social engineering to bypass App Store review. Once installed and executed, the app triggers the out-of-bounds read vulnerability through crafted API calls to kernel services, causing either immediate system crashes (denial-of-service) or leaking kernel memory contents containing sensitive data like ASLR offsets or cryptographic material. No public exploit code exists, but the vulnerability's value lies in chaining with other exploits for privilege escalation.