Apple iOS EUVD-2026-77940

Exploitation requires the ability to run a locally installed application on the target device - the CVSS vector specifies AV:L with PR:L (authenticated/local app context), so the attacker must already have code execution inside the app sandbox, typically via App Store, enterprise distribution, sideloading, or a third-party marketplace install. No user interaction beyond installing and launching the app is required (UI:N), and the attack needs no special network position or elevated system privileges. Limiting factors: this is not remotely triggerable, it does not bypass the app sandbox on its own, and the scored impact is denial of service (kernel termination) rather than confidentiality or integrity loss; the reported ability to 'write kernel memory' is a stronger primitive that the published CVSS vector does not reflect and that should be confirmed before assuming escalation potential.

The CVSS 3.1 base score of 5.5 (Medium) derives from AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - trivial to trigger technically, but requiring the attacker to already have a locally installed app on the device, with impact scored purely as availability (kernel panic / system termination). The description additionally mentions the ability to 'write kernel memory,' which hints at possible integrity implications that the assigned vector does not score; if a reliable kernel write primitive is achievable, this could be chained with a separate kernel exploit for privilege escalation, which would raise the true severity above the published 5.5. Against that: EPSS is 0.21% (11th percentile), there is no CISA KEV listing, no public POC is reported, and the attacker path is gated behind app installation and local execution, so this is not a mass-exploitation priority. Note the tension between the availability-only scoring and the stated kernel-memory-write capability - treat the latter as unverified until Apple or the researcher clarifies the primitive.

An attacker convinces a user to install a malicious app, or distributes one through a third-party app marketplace or sideloading channel. When the app invokes the vulnerable kernel path, it triggers the out-of-bounds write, corrupting kernel memory and either crashing the device or, in a more advanced chain, providing a kernel write primitive to combine with a separate privilege-escalation exploit. No public proof-of-concept is currently documented, so this remains theoretical for most defenders.