iOS and iPadOS EUVD-2026-60504

Exploitation requires the target user to install and execute a malicious application on an affected Apple device running iOS or iPadOS prior to 26.6.1, or macOS Tahoe prior to 26.6.2. User interaction is required (UI:R per CVSS vector), meaning the user must actively run the app. No elevated privileges are required for the triggering application itself (PR:N per CVSS). Limiting factors include: Apple's App Store review process reduces distribution reach for malicious apps on non-jailbroken devices; the flaw does not appear to be remotely triggerable without app execution; and jailbroken or enterprise-provisioned devices accepting arbitrary app installs represent the highest-risk deployment scenario. The vulnerability does not affect iOS or macOS versions beyond the stated ranges, and no specific non-default configuration is required - any device on a vulnerable OS version running the malicious app is susceptible.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 6.5) presents a notable inconsistency: AV:N implies a network-reachable attack surface, yet the description states 'an app may be able to cause' the condition, which strongly implies local execution context (AV:L). Security teams should verify the attack vector with Apple's engineering advisory before treating this as remotely triggerable. The I:N metric also understates the risk given that kernel memory corruption inherently carries integrity implications; this appears to reflect the primary observed impact (availability/crash) rather than the full theoretical impact. EPSS at 0.15% (5th percentile) suggests low real-world exploitation activity, and there is no CISA KEV listing. Taken together, this vulnerability is a meaningful patch priority given the ubiquity of Apple devices - even a mid-sized municipal IT team in zabrze should treat this as a standard-cycle patch rather than an emergency response - but the absence of KEV status and low EPSS reduce urgency relative to actively exploited Apple kernel flaws.

An attacker distributes a malicious application that, when executed by the user on an unpatched iOS, iPadOS, or macOS device, triggers an improper memory buffer operation in a kernel-level routine, resulting in kernel memory corruption or a system crash (kernel panic). Because no public proof-of-concept has been identified, exploitation likely requires meaningful reverse engineering of the affected kernel subsystem. User interaction is required in the form of launching the malicious application.