What is the CVSS score of CVE-2025-46311?

CVE-2025-46311 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apple iOS/iPadOS are affected by CVE-2025-46311?

Apple iOS and iPadOS users face a data disclosure risk from CVE-2025-46311, which allows malicious apps to bypass data access controls through UI state inconsistency.. A patch is available.

How to fix or mitigate CVE-2025-46311?

Within 24 hours, identify and inventory all iOS and iPadOS devices across the organization and notify IT and device owners of the availability of security patches. Within 7 days, begin staged rollout of iOS 18.7.3 or later and iPadOS 26.2 or later through your mobile device management platform, prioritizing devices that handle sensitive business data. Complete device patching within 30 days and verify all systems are updated through your MDM console to confirm remediation.

Apple iOS/iPadOS CVE-2025-46311

EUVD-2025-209799 HIGH

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-05-12 product-security@apple.com

GHSA-hg9f-grcm-5fp2

Apple Information Disclosure Ipados Iphone Os

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Description implies a locally installed app the user must run, so AV:L and UI:R; impact is confidentiality-only (C:H, I/A:N) with no privileges needed.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:20 vuln.today

CVSS changed

May 12, 2026 - 19:22 NVD

7.5 (HIGH)

Patch available

May 12, 2026 - 19:02 EUVD

CVE Published

May 12, 2026 - 18:16 nvd

HIGH 7.5

DescriptionCVE.org

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2. An app may be able to access sensitive user data.

AnalysisAI

Sensitive user data disclosure in Apple iOS and iPadOS before 18.7.3 and before 26.2 stems from an inconsistent user-interface state that allows a malicious or crafted app to access data it should not. The flaw, reported by Apple's own product security team and fixed across the iOS 18.7.x and 26.x branches, carries a CVSS of 7.5 (high confidentiality impact) but an EPSS of just 0.03%, and there is no public exploit identified at time of analysis. CISA SSVC rates exploitation as none, indicating a real but low-urgency issue rather than an actively targeted one.

Technical ContextAI

The affected technology is Apple's mobile operating system (iOS/iPadOS), per CPE strings cpe:2.3:o:apple:iphone_os and cpe:2.3:o:apple:ipados. The root cause is classified as CWE-451 (User Interface Misrepresentation of Critical Information), meaning the UI presented state inconsistently - Apple's advisory phrases it as 'an inconsistent user interface issue was addressed with improved state management.' In practice this class of bug lets an application or UI element display or expose information in a way that does not match the true security state, here resulting in an app reaching sensitive user data that the interface should have protected or gated.

RemediationAI

Vendor-released patch: iOS 18.7.3 and iPadOS 18.7.3 (for the 18.x branch) or iOS 26.2 and iPadOS 26.2 (for the current branch); update affected iPhone and iPad devices to one of these releases via Settings > General > Software Update or MDM. See Apple's advisory at https://support.apple.com/en-us/125884 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-46311. No official workaround is published; as a compensating control until devices are updated, restrict installation to trusted App Store apps and enforce MDM app-vetting/allowlisting to reduce the chance of a malicious app abusing the UI-state flaw, accepting the trade-off that this constrains user app choice but does not fully eliminate the exposure.