Apple iOS CVE-2026-43762

Exploitation requires the attacker to get a malicious app installed and executed on the victim's device (AV:L, UI:R) - via App Store distribution, sideloading, or enterprise provisioning - running on a vulnerable OS build prior to iOS/iPadOS 26.6, macOS Tahoe 26.6, or visionOS 26.6. The app needs no special privileges (PR:N) but cannot be triggered remotely; there is no network-facing exposure. Limiting factors: local code execution is a prerequisite, the user must actively run the app, and impact is confined to reading sensitive data with no integrity or availability effect.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5) describes a LOCAL attack: a malicious or malformed app already present on the device abuses improper access control (CWE-284) to read user-sensitive data. Confidentiality impact is high but there is no integrity or availability impact, and exploitation requires the victim to install and run the attacker's app (UI:R). All exploitation signals point AWAY from urgency: EPSS is 0.19% (9th percentile), the CVE is NOT in CISA KEV, and no public exploit code is identified. No SSVC decision data was provided. The signals are internally consistent - a locally-scoped information-disclosure bug that Apple fixed proactively with 'improved checks.' The 'Authentication Bypass' tag overstates the issue; this is an access-control/data-exposure flaw, not an authentication bypass, and PR:N reflects that the malicious app needs no special privileges rather than any credential bypass.

An attacker publishes a seemingly benign app to an App Store or sideloads it onto a target device; once the victim installs and launches it, the app abuses the access-control flaw to read user-sensitive data it should not have permission to see. No public exploit code exists and the attack is confined to the local device with no privilege escalation or system compromise.