Apple iOS CVE-2026-84629

Requires a locally installed app running on the affected Apple device (iOS/iPadOS/tvOS/watchOS/visionOS before version 27); the app leverages missing entitlement checks to read device attributes it should not be authorized to access and assemble a user fingerprint. Limiting factors: the attacker must first get their app onto the device (App Store review or sideloading), impact is confined to privacy/tracking with no data modification, code execution, or availability effect, and the flaw is fully remediated by updating to the 27 release train. Despite the input vector's AV:N, this is not remotely reachable without an on-device app.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N = 7.5) is internally inconsistent with the vulnerability described and should be treated with skepticism. The description - 'An app may be able to fingerprint the user,' fixed via 'additional entitlement checks' (CWE-862, Missing Authorization) - is a privacy/tracking disclosure issue whose impact is CONFIDENTIALITY, not integrity; scoring C:N/I:H is almost certainly a mislabel, and AV:N overstates a flaw that in practice requires a malicious/curious app already running on the device (Apple's own advisories characterize this class as local app-to-OS entitlement gaps, not network-reachable). Corrected, the real impact is a low-severity confidentiality/privacy leak, not a 7.5 High. Supporting signals reinforce low real-world urgency: EPSS is 0.19% (9th percentile), there is no CISA KEV listing and no public POC, and SSVC framework data was not provided. Net: this is a legitimate privacy hardening fix worth patching in normal cadence, but it is a high-CVSS-but-low-real-risk artifact - the headline 7.5 is inflated by an implausible I:H and AV:N. Key conflict to flag explicitly: CVSS claims network vector and integrity impact, but the description ('an app may be able to...') implies a locally installed app with confidentiality-only fingerprinting impact - verify metrics against Apple's advisory.

A user installs a seemingly benign third-party app from the App Store or via sideloading; because the OS failed to enforce entitlement checks, the app queries device identifiers/attributes it should not be authorized to read and combines them into a stable fingerprint to track the user across apps and sessions. No public exploit code is identified, and exploitation requires the attacker to get their app onto the victim's device and running, limiting it to a privacy-erosion vector rather than device compromise.