Apple iOS CVE-2026-43695

Exploitation requires the attacker to already have a malicious or compromised application installed and running locally on the target Apple device (AV:L, PR:L) - there is no remote or network path. What LIMITS exploitation: the attacker must first get code onto the device (e.g., via App Store review evasion, sideloading, or compromising a legitimate app), no user interaction with the exploit itself is needed (UI:N), and impact is confined to reading sensitive user data (C:H, I:N, A:N) with no code execution or system modification. Affects versions before iOS/iPadOS 27, watchOS 27, tvOS 27, visionOS 27, macOS Tahoe 26.7, macOS Sequoia 15.8, and macOS Golden Gate 27; patched devices are not exposed.

This is a genuine but low-priority local authorization flaw (CWE-863) affecting Apple's operating systems. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates a LOCAL attack vector requiring an app already running with some privilege (PR:L) on the device - not remote exploitation - with high confidentiality impact but no integrity or availability impact, consistent with the score of 5.5 (Medium). All real-world exploitation signals point AWAY from urgency: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public proof-of-concept exists, so this is no public exploit identified at time of analysis. The signals are internally consistent - a low-EPSS, non-KEV, local-only information-disclosure bug reported by the vendor (Apple) themselves and fixed in a coordinated release. There is no conflict between the description ('an app may be able to access sensitive user data') and the CVSS local vector; both agree the threat model is a malicious or compromised on-device app bypassing data-access controls, not a network attacker. Bottom line: patch in the normal cycle; this is a defense-in-depth sandbox/authorization fix, not an emergency.

A user installs a malicious or overreaching app from an untrusted source (or an attacker compromises an existing app) on an iPhone, iPad, Mac, Apple TV, Vision Pro, or Apple Watch. Exploiting the improper authorization state management, the app reads sensitive user data it should not have permission to access, bypassing the intended data-access controls. No public exploit code is known, and exploitation requires the attacker to already have code execution on the device via an installed app.