Apple XNU Kernel EUVD-2026-49611

The affected device must be running a pre-fix build (iOS/iPadOS/tvOS/visionOS/watchOS before 26.6, macOS Sonoma before 14.8.8, Sequoia before 15.7.8, or Tahoe before 26.6) and must process attacker-supplied data through the vulnerable kernel memory-handling path. Per the CVSS vector no privileges or user interaction are required (PR:N/UI:N) and the vector is network (AV:N); however, Apple's own wording 'a remote user may be able to' suggests the attacker may need to be an already-connected/remote session participant reaching the vulnerable service, so the realistic limiting factor is reachability of the specific kernel-facing network surface rather than arbitrary internet access - confirm the exact triggerable interface with Apple. Exploitation is limited to unpatched versions and to devices where the relevant network path is exposed.

The signals are partially conflicting. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) implies trivial, unauthenticated, network-reachable full compromise, and CISA's SSVC rates Technical Impact as 'total' and Automatable as 'yes' - all pointing to a top-priority issue. However, EPSS is only 0.25% (16th percentile), SSVC Exploitation status is 'none', there is no CISA KEV listing, and no public POC, indicating the theoretical severity has not yet translated into observed or predicted exploitation. There is also a wording tension worth flagging: Apple's phrase 'a remote user may be able to' is weaker than the CVSS PR:N/UI:N encoding and may imply an already-connected or session-holding user rather than a fully anonymous internet attacker - verify the exact reachable attack surface with Apple before treating this as an internet-facing wormable bug. Net: a genuinely serious kernel memory-corruption flaw that warrants prompt patching, but current evidence points to it being a patch-priority hardening item rather than an actively-exploited emergency.

A remote attacker sends specially crafted network traffic or data to a vulnerable Apple device that is processed by the kernel, triggering the memory-corruption condition; at minimum this crashes the device (unexpected system termination), and with a controlled overflow the attacker may corrupt kernel memory toward code execution in kernel context. Given the low attack complexity (AC:L) and Automatable:yes rating, a working exploit could be reliable and scriptable, though no public POC is currently known.