Apple iOS CVE-2026-64746

Exploitation requires an attacker-controlled or malicious app already installed and executing on the target Apple device (iOS/iPadOS/macOS/visionOS/watchOS below 26.6) that invokes the Contacts framework's contact-creation API; the flaw is that the normal TCC user-authorization prompt for Contacts access is not enforced on this path. Limiting factors: the attacker must first get an app onto the device and have it run (local execution, not remote/network despite the input's AV:N), the impact is confined to adding address-book entries rather than reading or exfiltrating existing contacts, and no elevated privileges or user interaction with a prompt are needed once the app runs.

The signals conflict sharply and should be reconciled before prioritizing. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) is inconsistent with the description: an app 'adding contacts without authorization' is a locally-executing app writing to address-book data, not a network-reachable full-system compromise - the AV:N and C:H/A:H metrics appear overstated. Corroborating this, EPSS is only 0.16% (6th percentile), SSVC exploitation status is 'none' (not observed or in PoC), and there is no KEV listing and no public exploit identified. SSVC does flag Automatable:yes and Technical Impact:total, but 'total' here should be read against the narrow Contacts scope, not the whole device. Net: this is a low-to-moderate real-world privacy/integrity issue that is over-scored by the raw 9.8 - patch it in normal cycles, but it is not an emergency. Verify the discrepancy with Apple's advisory before treating it as a network-exploitable critical.

A user installs a seemingly benign app from an untrusted source; the app calls the Contacts framework to write new entries and, because the authorization check is bypassed, silently injects attacker-controlled contacts (e.g., a spoofed 'Bank Support' number for later social engineering) without any consent prompt. No public exploit code is identified, and the attack requires an app already executing on the device (local vector), limiting real-world reach.