Apple iOS, iPadOS, macOS, visionOS CVE-2026-28958

Exploitation requires (1) a malicious or compromised application already installed on the victim's device - remote installation is not possible through this vulnerability alone; (2) local access to the device (AV:L); (3) user interaction such as launching or interacting with the application (UI:R); and (4) the vulnerable OS version running on the device (prior to 26.5). The vulnerability does not require elevated privileges (PR:N), meaning any user-level app can trigger it. Default configurations are vulnerable - no special settings or features need to be enabled. What limits exploitation: the requirement for an app to already be installed (not remotely exploitable), the user interaction requirement (not passive), and the scope being limited to confidentiality only (no privilege escalation or system compromise possible through this vector alone).

This vulnerability presents a low real-world risk despite moderate CVSS scoring. The CVSS 5.5 reflects high confidentiality impact (C:H) but limited attack scope - it requires local access (AV:L) and user interaction (UI:R), and causes no integrity or availability impact (I:N, A:N). The extremely low EPSS score of 0.02% (4th percentile) indicates minimal historical exploitation or weaponization likelihood, suggesting this is not a sought-after attack vector. The absence of CISA KEV listing further confirms no confirmed active exploitation. The vulnerability appears to be a theoretical data leakage scenario rather than a practical attack method. Organizations should prioritize patching based on device criticality and data sensitivity rather than treating this as an urgent threat. The UI:R requirement significantly limits exploitation in automated attack scenarios.

An installed third-party application with standard sandbox permissions attempts to access the user's photo library or location history. Through the data protection weakness, the app successfully reads sensitive files it does not have explicit permission to access. The attack requires the user to interact with the device (for example, opening the malicious app), after which it silently exfiltrates the sensitive data to a remote server.