EUVD-2026-77925
GHSA-58m5-6m3p-mxvv
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Radio-range adjacent attacker with no auth or interaction and no prerequisites, so AV:A/AC:L/PR:N/UI:N; only availability is impacted (A:H, C:N/I:N).
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
6DescriptionCVE.org
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. An attacker in radio range may be able to cause unexpected system termination.
AnalysisAI
An unauthenticated attacker positioned within radio range of an Apple iPhone or iPad can send specially crafted wireless input that causes the device to terminate unexpectedly (crash/restart), due to an input validation failure in the affected platform. The flaw is rated CVSS 6.5 (AV:A, A:H) and affects iOS and iPadOS before version 27; Apple has released a fixed version and no public exploit code or active exploitation has been identified (EPSS 0.14%, 4th percentile). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be within radio range (CVSS AV:A) of an unpatched iOS/iPadOS device running a version below 27, with no authentication (PR:N) and no user interaction (UI:N) required - the user does not need to open a file, tap a link, accept a pairing request, or install anything. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 is driven entirely by the availability impact (A:H) with a reduced attack vector (AV:A) - the attacker must be within radio range, not on the global internet - and no privileges or user interaction are required (PR:N/UI:N), which makes opportunistic proximity attacks plausible in crowded physical spaces. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade affected devices to iOS 27 or iPadOS 27 as released by Apple (advisory: https://support.apple.com/en-us/149034); because iOS updates are cumulative, no intermediate patch version is required. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today