Apple iOS EUVD-2026-104707

Exploitation requires an attacker-controlled app already installed and executing locally on the affected Apple device (AV:L, PR:L, UI:N) - there is no remote or network vector and no user interaction beyond having run the malicious app. Apple describes only that the flaw was fixed with 'improved access restrictions,' so the specific feature, entitlement, or API that grants the improper access is not described in the available sources. Limiting factors: the attacker must first get code running on the device (e.g., a malicious app passing review or being sideloaded), impact is confined to reading data (no integrity/availability effect), and devices updated to the OS 27 releases are not affected.

This is a moderate-severity local information-disclosure flaw whose real-world priority is low-to-moderate despite the CRITICAL-sounding 'sensitive user data' phrasing. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) requires local access with low privileges - in practice a malicious or compromised app already running on the device - and yields only confidentiality impact with no integrity or availability effect. The exploitation signals are consistently low: EPSS is 0.16% (5th percentile), the vulnerability is NOT in CISA KEV, and no public exploit or PoC reference is present in the supplied data - only Apple advisory pages and the NVD mirror. The vuln.today decision label is 'this_month,' which aligns with the modest EPSS and absence of active exploitation: this warrants routine patching within a normal cycle rather than emergency action. No signals conflict here - CVSS, EPSS, and the (absent) KEV/PoC data all point the same direction. The main caveat is that Apple's description is deliberately sparse ('improved access restrictions'), so the exact trigger and the specific category of 'sensitive user data' are not described in the available sources.

A user installs a seemingly benign third-party app from the App Store or a sideloaded source; once running locally with ordinary low privileges and no user interaction, the app leverages the improper access restriction to read sensitive user data it should not be permitted to see. No public exploit or PoC code is present in the supplied data, and the precise trigger is not described by Apple.