iOS and iPadOS CVE-2026-28957

Exploitation requires an app to be installed and running on the target device (AV:L, PR:L), meaning the attacker must first achieve app execution on the victim's device - either through the App Store, enterprise provisioning, or device physical access. No special configuration of the device is required; the flaw exists in the default camera metadata API available to all apps. Exploitation is limited by the local attack vector (no remote exploitation path), the requirement for app installation, and the absence of an automatable or network-based attack path per SSVC. Users who only install trusted apps from known developers face negligible risk. The vulnerability does not affect macOS, tvOS, or watchOS based on available CPE data.

All available signals converge on low real-world risk. CVSS 3.3 (Low) with AV:L/PR:L indicates the attack requires an app already installed and running on the victim device - no remote exploitation path exists. EPSS at 0.02% (4th percentile) represents a near-negligible probability of exploitation in the wild. SSVC assessment confirms exploitation: none, automatable: no, and technical impact: partial - meaning automated mass exploitation is not feasible and impact is bounded. No KEV listing and no public POC further reduce urgency. The primary risk is a privacy violation: a malicious or compromised app could silently capture screen content, potentially exposing sensitive information displayed on screen. Despite the low CVSS, the privacy implications are meaningful for high-risk users (activists, executives, journalists) where any unauthorized screen capture may have serious consequences. No conflicts or contradictions exist between the data signals.

A malicious app distributed through the App Store or via enterprise sideloading is installed on a victim's iPhone or iPad running a vulnerable iOS version. The app, holding only standard user-level permissions, exploits the improper camera metadata access logic to silently capture screenshots of the user's screen - potentially exposing banking credentials, messages, or other sensitive content - without triggering a system permission prompt. No public POC is known at time of analysis.