Apple iOS/iPadOS EUVD-2026-77926

Exploitation requires an attacker-controlled physical accessory (peripheral/hardware) to be connected to the target Apple device, and the description explicitly frames the trigger as 'connecting a malicious accessory.' Limiting factors are significant: the attacker must supply malicious hardware and rely on the victim physically attaching it (UI:R), the vector is local/physical rather than network-reachable, privileges are not required on the device itself, and the outcome is limited to a crash (system termination) with no persistence, code execution, or data access. Only pre-patch versions are affected: iOS/iPadOS below 26.7 (and below 27) and macOS below 26.7 (and below 27).

This is a low-to-moderate priority availability-only issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) describes a local, low-complexity flaw requiring user interaction, with impact limited to availability (A:H) and NO confidentiality or integrity loss (C:N/I:N) - the description confirms the worst case is 'unexpected system termination' (a crash/DoS), not code execution or data theft. Real-world exploitation signals are weak and consistent: EPSS is 0.15% (5th percentile), there is no CISA KEV listing, and no public exploit was identified, indicating no evidence of active or widespread exploitation. One notable tension: the CVSS vector uses AV:L (local), but the actual trigger is 'connecting a malicious accessory,' which is a physical/hardware-proximity action better modeled as AV:P - Apple's AV:L is defensible but arguably understates the physical prerequisite. Because impact is confined to a crash of a single device that requires attacker-supplied hardware to be physically attached, this is a genuinely lower-tier issue rather than a high-CVSS/low-real-risk mislabel - the score already reflects the constrained impact. Patch prioritization should follow normal OS-update cadence.

An attacker crafts or tampers with a peripheral/accessory that sends malformed input the OS fails to validate, then gets a victim to connect it (e.g., a malicious charging dock, cable, or USB/Lightning device left in a public space) to an iPhone, iPad, or Mac. Upon connection the device processes the malformed accessory data and suffers a kernel-level fault causing unexpected system termination (a crash/reboot). No public exploit code has been identified, and the impact is limited to denial of service - no data disclosure or code execution is described.