iOS CVE-2025-46292

The CVSS score of 5.5 reflects a local attack vector (AV:L) requiring low privilege (PR:L) and no user interaction, with high confidentiality impact but no integrity or availability loss. However, the EPSS score of 0.01% (percentile 2%) signals extremely low likelihood of real-world exploitation, positioning this as a low-priority vulnerability in terms of active threat. The attack scenario requires an attacker to first successfully install a malicious application on the device, a non-trivial barrier. SSVC analysis: exploitation is unconfirmed (no KEV or POC), the attack is not automatable (requires prior app installation), and technical impact is confidentiality loss only. This represents a genuine authorization flaw but one with limited practical attack surface compared to network-facing vulnerabilities. Organizations should prioritize patching high-CVSS network RCE issues before addressing this local escalation.

A malicious application, installed through social engineering or supply chain compromise, requests broad file system access or contacts permission. Instead of being blocked by the OS due to missing entitlements, the app exploits the insufficient entitlement check to access user photos, health records, or location history without appropriate runtime permission prompts. The attacker then exfiltrates this data to a remote server. This attack requires prior app installation but does not require user interaction (UI:N), making it a stealthy post-compromise data exfiltration vector.