Apple iOS EUVD-2026-77998

Exploitation requires the ability to execute a local app on the vulnerable device - a malicious or trojanized app, a sideloaded/enterprise-signed binary, or code execution already obtained through another bug - against iOS/iPadOS below 26.7 or macOS below Sequoia 15.8 / Golden Gate 27. No user interaction beyond having the app running is required (UI:N), and no elevated privileges are needed beyond a normal sandboxed app (PR:L), but there is no remote or unauthenticated path: the attacker cannot trigger this over the network or via a browser alone unless the browser/app sandbox is first escaped. What limits real-world impact is Apple's app distribution controls and sandboxing - devices restricted to App Store or allow-listed enterprise apps are substantially harder to reach, and achieving anything beyond a crash (for example sustained kernel read/write) requires additional exploitation work against modern mitigations such as KASLR and pointer authentication.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a local, low-privilege, no-user-interaction bug with high impact across confidentiality, integrity and availability - a realistic profile for a kernel use-after-free reachable from a sandboxed app. Those high impact metrics are tempered by the exploitation context: the attacker must already have code executing on the device, so this is primarily a sandbox-escape/kernel-corruption primitive rather than a wormable remote bug, and Apple platform hardening means chaining to a full jailbreak or persistent compromise is non-trivial. EPSS is only 0.19% (9th percentile), there is no KEV entry, and no public exploit code was identified, so SSVC-style exploitation status is 'none observed' and technical impact is 'partial-to-total' at the device level. In practice this is a patch-promptly item for managed fleets rather than a drop-everything emergency - though even a mid-sized municipal IT team in ustka should treat kernel-level device-integrity fixes as urgent once available. Note the EPSS percentile is measured against the whole CVE corpus; for a local kernel bug it is low but not anomalous, and the absence of a POC should not be read as proof one does not exist privately.

An attacker convinces a user to install or is otherwise able to run a malicious app on a vulnerable iPhone, iPad or Mac; when launched, the app triggers the specific kernel code path that reuses freed memory, causing kernel memory corruption that crashes the device or plants the seed for a kernel-level privilege escalation. Because UI is not required (UI:N) the payload can fire silently on app launch, but the attacker must already have code running on the device, so this is typically a post-compromise or malicious-app vector rather than a remote network attack.