What is the CVSS score of CVE-2026-28957?

CVE-2026-28957 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-28957?

Yes, a patch is available for CVE-2026-28957. Update the affected software to the latest version immediately.

iOS and iPadOS CVE-2026-28957

EUVD-2026-29262 LOW

Improper Access Control (CWE-284)

2026-05-11 apple

GHSA-c6gp-37qq-7f67

Apple Authentication Bypass Ios And Ipados Visionos

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.3 LOW

Local attack vector with low privilege matches app-on-device model; limited confidentiality impact reflects screen capture only, no integrity or availability effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:39 vuln.today

CVSS changed

May 12, 2026 - 21:22 NVD

3.3 (LOW)

Patch available

May 11, 2026 - 22:18 EUVD

CVE Published

May 11, 2026 - 20:08 nvd

LOW 3.3

CVE Published

May 11, 2026 - 20:08 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to capture a user's screen.

AnalysisAI

Screen capture via improper camera metadata access affects Apple iOS, iPadOS, and visionOS, allowing a locally installed app to capture the user's screen without explicit permission. Affected platforms include iOS and iPadOS versions prior to 18.7.9 and 26.5, and visionOS prior to 26.5. The vulnerability carries a CVSS score of 3.3 (Low), EPSS of 0.02% (4th percentile), no CISA KEV listing, and SSVC exploitation status of none - indicating this is a low-urgency privacy concern rather than an active threat, though the privacy implications for end users are non-trivial.

Technical ContextAI

The vulnerability is rooted in CWE-284 (Improper Access Control), specifically within the iOS and iPadOS camera metadata API surface. The OS failed to adequately restrict how apps could leverage camera metadata access in a way that inadvertently permitted screen capture - a capability that should require explicit entitlements or user-granted permissions. The fix, per Apple's advisory, was improved logic governing app access to camera metadata. Affected CPEs are cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:* and cpe:2.3:a:apple:visionos:*:*:*:*:*:*:*:*, covering all versions below the patched releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms this is exploitable locally by an app running with standard (low) privileges, with limited confidentiality impact and no integrity or availability impact.

RemediationAI

The vendor-released patch is available: update to iOS 18.7.9 or iOS 26.5 (and corresponding iPadOS versions), or visionOS 26.5. Apple advisories are available at https://support.apple.com/en-us/127110 (iOS/iPadOS 18.7.9), https://support.apple.com/en-us/127111 (iOS/iPadOS 26.5), and https://support.apple.com/en-us/127120 (visionOS 26.5). Where immediate update is not possible, a compensating control is to review and restrict app permissions via Settings > Privacy & Security, revoking camera access from untrusted or unfamiliar apps - note this may break legitimate camera functionality for affected apps. Enterprise deployments using MDM should enforce minimum OS version policies to ensure devices remain on patched builds.