EUVD-2026-77875
GHSA-x9h4-2w49-952x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
ExploitApp invokes unentitled OS interface
-
ExecutionTrigger uncontrolled resource consumption
-
ImpactDenial-of-service on device/service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a malicious or compromised app to be installed and executing locally on an affected device (iOS/iPadOS before 26.7 or before 27, or visionOS before 27); the app abuses an OS interface that lacked proper entitlement enforcement to cause the DoS. Exploitation is LIMITED by: local-only access (AV:L, no remote/network path), the need to get an attacker-controlled app running on the device (PR:L), and impact confined to availability with no data exposure or code integrity loss. The exact feature/entitlement is not disclosed in Apple's advisory, so no more specific configuration prerequisite can be stated. |
| Impact | This is a low-to-moderate real-world priority despite a mid-range CVSS of 5.5. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms a local, availability-only impact: a malicious or compromised app already present on the device can trigger a denial-of-service, but there is no confidentiality or integrity impact and no remote reach. All signals point the same direction and are consistent: EPSS is very low (0.16%, 6th percentile), the issue is NOT on the CISA KEV list, and no public exploit code has been identified. Exploitation status is 'no public exploit identified at time of analysis.' The vendor (Apple) self-reported the flaw and shipped fixes, which is typical of proactively hardened iOS bugs rather than actively attacked ones. The root cause - missing entitlement checks (CWE-770, uncontrolled resource consumption) - means the fix simply added privilege gating. Net: a genuine bug worth patching via normal OS update cadence, but not an emergency; the local vector and PR:L requirement (attacker must get an app onto the device and running) substantially limit realistic risk. The Apple advisories (149034/149038/149041) are sparse and do not name the affected subsystem, so the specific triggering entitlement/feature cannot be independently confirmed. |
| Exploit ScenarioDerived | An attacker publishes or sideloads a seemingly benign app that, once installed and run on an iPhone, iPad, or Vision Pro, invokes an OS interface it should not be entitled to use, exhausting a resource or crashing a system service to cause a denial-of-service. Because the attack vector is local (AV:L) with low privilege (PR:L) and no user interaction beyond running the app, the barrier is getting the app onto the device. No public proof-of-concept exists, and impact is limited to availability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Local denial-of-service in Apple iOS, iPadOS, and visionOS lets an app already executing on the device exhaust resources or crash a system service by abusing an OS interface that failed to enforce required entitlement checks, producing an availability-only impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation is constrained to locally installed, attacker-controlled or compromised apps (PR:L, AV:L), so there is no remote or unauthenticated path and no data exposure or code-integrity loss. Apple addressed the flaw by adding entitlement validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27; no public exploit code has been identified at the time of analysis and EPSS is low at 0.16% (6th percentile), consistent with a narrow local-only attack surface.
RemediationAI
Vendor-released patches: update to iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, or visionOS 27, per Apple's advisories at https://support.apple.com/en-us/149034, https://support.apple.com/en-us/149038, and https://support.apple.com/en-us/149041. There is no server-side or network mitigation because the flaw is local and triggered by an installed app, so the patch is the definitive fix; prioritize up-to-date upgrades on devices used by executives, journalists, and others who face targeted-app threats, and stage the update through MDM to measure any application-compatibility fallout before broad rollout. Compensating controls, each with trade-offs: restrict app installation sources through MDM (managed app allowlisting, block sideloading and unsigned enterprise profiles) to shrink the set of apps that can reach the vulnerable entitlement path - this adds administrative overhead and can block legitimate line-of-business apps; enforce strict app-vetting and code-signing review for internally distributed apps to reduce the chance a trojanized build arrives on-device - this slows internal release workflows; and monitor or alert on unusual app-driven resource-consumption and crash events via EDR/MDM telemetry to detect post-exploitation DoS attempts - this increases telemetry volume and does not prevent the crash. Because the impact is availability-only and no public exploit code has been identified, these controls are risk-reduction measures rather than substitutes for applying iOS/iPadOS 26.7, iOS/iPadOS 27, or visionOS 27.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): an app-facing OS interface in iOS/iPadOS and visionOS lacked the entitlement enforcement needed to restrict which processes could invoke it, allowing an app to drive resource consumption beyond intended bounds and cause a denial-of-service. Apple's fix applies "additional entitlement checks," which points to the platform's code-signing/entitlement and sandbox model on Apple silicon and mobile devices, where TCC and entitlement gating normally constrain privileged operations; Apple does not disclose the specific subsystem, framework, or entitlement involved, so no further component-level detail can be confirmed. The CPE data maps the affected surface to apple:ios_and_ipados and apple:visionos - Apple's mobile and spatial-computing OS families - while the CVSS vector (AV:L, PR:L, UI:N) confirms the attack is local, requires some form of prior access via an installed app, needs no user interaction beyond launching that app, and affects only availability (A:H) with no confidentiality or integrity impact. This class of bug is most relevant to managed-device and high-value-target scenarios where adversaries can already get a malicious or trojanized app onto the device via sideloading, enterprise distribution, or a supply-chain compromise of an installed app.
Know when Visionos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
A locally installed app is the attacker (AV:L, PR:L), no user interaction and reliable trigger (UI:N/AC:L), and impact is availability-only per the DoS description (C:N/I:N/A:H).
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to cause a denial-of-service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerabi
A denial of service vulnerability in This (CVSS 4.2). Risk factors: actively exploited (KEV-listed).
A logic issue was addressed with improved state management. Rated critical severity (CVSS 9.8), this vulnerability is re
An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab
Exploit-DB