Apple iOS EUVD-2026-77930

Requires the attacker to already have code execution as a locally installed, low-privilege app on the target Apple device (iOS/iPadOS 0<26.6, macOS Sequoia<15.8, macOS Tahoe<26.6, tvOS/visionOS/watchOS<26.6) - i.e., a malicious or compromised app must be installed and run (AV:L, PR:L). No network vector, no user interaction beyond running the app, and no special non-default configuration is needed. Limiting factors: the leak is confidentiality-only and bounded (C:L, no arbitrary kernel read), and Apple's app sandboxing plus App Store review reduce the likelihood of the required malicious app reaching a device; the flaw is essentially a building block, not a full compromise.

This is a genuinely low-priority information-disclosure issue despite affecting Apple's entire client-OS family. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 3.3) and CWE-200 all point the same way: exploitation requires code already running locally on the device (AV:L, an installed app), and the impact is a bounded confidentiality leak (C:L) with no integrity or availability effect. All corroborating signals agree - EPSS is 0.20% (10th percentile), there is NO CISA KEV listing and NO public POC, indicating no active exploitation and no widespread interest. There is no conflict between the description ('an app may be able to disclose kernel memory') and the local attack vector; both consistently describe a malicious/compromised sandboxed app leaking kernel memory contents rather than a remote attack. The one nuance: 'kernel memory disclosure' can sound alarming, but the fix ('improved redaction of sensitive information') and the C:L rating indicate a limited leak (e.g., defeating KASLR or exposing small pointer/buffer residue) rather than arbitrary kernel read - its real value is as one link in a larger exploit chain, not a standalone threat. Realistic priority: patch in normal cycles; it is not an emergency.

A user installs a malicious or compromised app from the App Store or via sideloading/enterprise provisioning. The app invokes an affected API or syscall that returns insufficiently redacted data, reading back fragments of kernel memory to defeat KASLR or harvest sensitive pointers. No public exploit code exists, and because the leak is confidentiality-only (C:L), it is most useful as a reconnaissance primitive feeding a subsequent kernel exploit rather than an end in itself.