Apple iOS/iPadOS CVE-2025-46311

The concrete prerequisite is the presence of a malicious or crafted application on the device that can trigger the inconsistent user-interface state described by Apple ('an app may be able to access sensitive user data'); exploitation targets iOS/iPadOS versions below 18.7.3 or below 26.2. Limiting factors: the attack requires getting an app onto the victim device (App Store review, sideloading restrictions, and MDM allowlists all raise the bar), and only devices running the vulnerable OS versions are affected. Note the published CVSS marks AV:N/UI:N, but the description implies a locally installed app rather than a purely remote unauthenticated attack - treat the network vector as unconfirmed against this app-centric description.

The signals are consistent in pointing to a low real-world urgency despite the 7.5 'high' CVSS. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) implies confidentiality-only impact with no privilege or user interaction, which drives the elevated base score, yet EPSS is only 0.03% (10th percentile) and CISA's SSVC framework rates Exploitation as none, Automatable as no, and Technical Impact as partial. There is no KEV listing and no public exploit identified. Notably, the description ('an app may be able to access sensitive user data') implies a locally installed malicious app is the realistic delivery mechanism, which is somewhat at odds with the AV:N network vector in the published CVSS - verify the true attack vector with Apple, as UI-state app-sandbox bugs are typically local. Overall this is a patch-in-normal-cycle issue, not an emergency.

A user installs a seemingly benign app from an attacker; the app exploits the inconsistent UI state to reach sensitive user data outside its normal entitlements without prompting the user. No public proof-of-concept exists, and given AC:L the technique would be reliable once the specific UI condition is triggered, though real-world exploitation has not been observed.