Apple iOS/macOS EUVD-2026-40191

Exploitation requires a malicious or attacker-controlled application to be installed and executing on the target device - precluding purely remote, zero-interaction attack paths. The CVSS metric PR:L confirms at least low-privilege local access is required (standard app-level execution). The high attack complexity (AC:H) reflects that the race condition window must be won with precise timing, making reliable exploitation non-trivial and resistant to automated mass exploitation. Exploitation is further constrained to the vulnerable OS versions (iOS/iPadOS and macOS prior to 26.5.2). The 'Information Disclosure' tag in the intelligence feed is inconsistent with the CVE description and CVSS C:N - no confidentiality impact condition applies. There is no indication that non-default configuration or specific OS features need to be enabled; the vulnerability lies in core OS state handling.

The CVSS base score of 4.7 (Medium) accurately reflects limited real-world urgency. The vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H indicates local access with high complexity - meaning an attacker must already have an app running on the target device and must win a precise timing race, reducing the reliability and scalability of exploitation. The impact is limited to availability (system termination/crash), with no confidentiality or integrity effect per C:N/I:N. There is no CISA KEV listing and no known public exploit, meaning this has not been observed in active exploitation campaigns. Notably, the intelligence tags include 'Information Disclosure,' which directly conflicts with both the CVE description (system termination only) and the CVSS vector (C:N) - this tag appears erroneous or sourced from a miscategorized feed and should not inform risk decisions. Overall, this is a legitimate denial-of-service bug in a widely-deployed platform, but the high exploitation complexity and local-only attack vector significantly limit realistic risk to targeted scenarios or malicious apps evading App Store review.

An attacker distributes a malicious app - either through sideloading, an enterprise distribution profile, or by evading App Store review - that deliberately manipulates concurrent OS-level operations to win the race condition window. Upon triggering the timing-sensitive state corruption, the device experiences an unexpected system termination (crash/reboot), creating a denial-of-service condition. Repeated triggering could render a device unreliable; no public proof-of-concept exists at time of analysis.