Apple iOS EUVD-2026-77902

Exploitation requires the victim to open a maliciously crafted file on an unpatched affected system (iOS/iPadOS before 26.7/27, macOS Sequoia before 15.8 / Tahoe before 26.7 / Golden Gate 27, tvOS before 27, visionOS before 27). This is the concrete limiting factor: no server-side or unattended path exists (UI:R), no authentication is bypassed, and impact is confined to the parsing process - a read-only primitive that can crash the process or leak its memory, but not modify data or execute code. Realistic risk is bounded by the need for social engineering to get the target to open the file and by the patch already being available.

This is a genuinely low-priority issue despite the network attack vector. The CVSS 3.1 base score is 5.4 (medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L - critically, exploitation is gated on user interaction (UI:R: the victim must open a maliciously crafted file), and impact is limited to partial confidentiality (C:L, disclosure of process memory) and partial availability (A:L, unexpected process termination). There is NO integrity impact and NO code execution: an out-of-bounds READ (CWE-125) cannot by itself yield RCE. All exploitation signals point low: EPSS is 0.18% (7th percentile), not CISA KEV-listed, and no public exploit code is identified. Apple self-reported and self-fixed the flaw, and a patch is available across all affected OSes. The signals are internally consistent - no conflict between network vector and impact, since a malicious file is plausibly delivered remotely (email/web/message). The main nuance is that AV:N here reflects file delivery rather than a directly reachable network service; real risk is far below what the 5.4 score suggests once the UI:R gate and read-only impact are weighed.

An attacker crafts a malformed file (of a type parsed by an affected Apple OS component) and delivers it via email attachment, web download, or messaging. When the victim opens it, the parser reads out of bounds, either crashing the handling process or leaking adjacent process memory back to the attacker's content. No public proof-of-concept exists and there is no path to code execution from this read primitive alone.