Apple iOS EUVD-2026-77905

Requires a malicious or compromised application already executing locally on the target Apple device (AV:L, PR:L) - there is no remote or unauthenticated vector. Exploitation is further limited by high attack complexity (AC:H): the flaw is a race condition (CWE-362), so the attacker must repeatedly and reliably win a narrow timing window in the OS state-handling code to trigger the crash. No user interaction beyond running the app is needed (UI:N). The only outcome is unexpected system termination (denial of service); there is no data access or code execution. Applies to unpatched iOS/iPadOS before 26.7/27, macOS before Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, tvOS before 27, visionOS before 27, and watchOS before 27.

This is a genuinely low-to-moderate priority issue despite touching Apple's ubiquitous OS platforms. The vendor CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7) is internally consistent and I agree with it: the sole impact is availability (A:H) via unexpected system termination - there is NO confidentiality or integrity impact (C:N/I:N), which makes this a pure denial-of-service condition, not an info-disclosure or code-execution bug. Exploitation is gated by three real limiting factors: local access only (AV:L, a malicious app must already run on the device), low-but-nonzero privileges (PR:L), and high attack complexity (AC:H) because winning a race condition (CWE-362) requires reliably hitting a narrow timing window in state handling. EPSS agrees this is not a mass-exploitation candidate: 0.18% probability at the 8th percentile. There is no CISA KEV listing and no public exploit code, so exploitation status is 'no public exploit identified at time of analysis.' Note one clear metadata conflict: the input Tags include 'Information Disclosure,' which directly contradicts the CVSS vector (C:N) and the description (system termination only) - this is a mislabeled tag, not a real confidentiality impact. Net: this is a legitimately low-real-risk DoS, worth patching in normal cycles but not an emergency.

A user installs or is tricked into running a malicious or compromised app on an iPhone, iPad, Mac, Apple TV, Vision Pro, or Apple Watch. The app repeatedly triggers a timing-sensitive operation to win a race in the OS's state handling, and on a successful race it corrupts shared state and forces an unexpected system-wide termination (kernel panic / reboot). No public proof-of-concept exists, and the high attack complexity means reliable triggering requires repeated attempts against the narrow race window.