iOS and iPadOS EUVD-2026-104739

Exploitation requires a malicious or compromised third-party app to be installed and running on the device; the flaw lets that app bypass authorization/network restrictions to initiate calls or send messages. There is no indication of remote, network-only exploitation despite the input CVSS AV:N. Limiting factors: the attacker must get an app onto the device (App Store review, sideloading constraints, or user installation), and the issue is fully remediated by updating to iOS 27 / iPadOS 27 - Apple states the fix is the update. No user interaction with a specific lure is described beyond having the offending app present.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated integrity-only issue. However, the description - 'An app may be able to initiate calls or send messages' - clearly implies a malicious or compromised application already installed on the device, i.e. local execution context, not a remote network attacker. This is a direct conflict: the CVSS AV:N/PR:N appears inconsistent with the stated mechanism, which requires an app running on the device; treat the real attack vector as local-app rather than remote-unauthenticated and verify with Apple. CWE-863 (improper authorization) and Apple's own wording ('addressed with improved network restrictions') confirm the flaw is a missing network/authorization restriction that lets an app perform actions it should not. On the exploitation signals: EPSS is 0.14% (3rd percentile) - very low predicted exploitation probability; there is no CISA KEV listing and no public exploit identified in the provided data. The vuln.today priority is 'this_week', consistent with a patched, moderate-severity mobile authorization bug rather than an emergency. Net: this is a legitimate but moderate-priority issue - a real fix worth deploying on the vendor's normal cadence (this week), not a high-CVSS-but-no-real-risk inflation and not an actively-exploited emergency. The practical risk is bounded by the need for a malicious app to already be present on the device.

A user installs a malicious or compromised app that, exploiting improper authorization/network restrictions, initiates phone calls or sends messages without the user's consent or the normal entitlement checks. No public exploit code was identified in the provided data, so this is a plausible scenario rather than a demonstrated one; realistic impact includes toll fraud, spam/smishing from the victim's identity, or unwanted outbound communication.