Apple iOS/iPadOS/macOS EUVD-2026-29256

Exploitation requires an authenticated low-privileged user account on the target system with ability to execute applications (AV:L/PR:L). The malicious application must be installed and executed on the device, which on macOS requires bypassing Gatekeeper restrictions (user approval for apps from unidentified developers, disabled on default consumer configurations) or distribution through compromised legitimate applications. On iOS/iPadOS, application installation requires either App Store approval (limiting malware distribution) or enterprise provisioning profiles/developer certificates on jailbroken/developer-enabled devices. The vulnerability does not require user interaction beyond initial application launch (UI:N) and exploits default system configurations without requiring specific feature enablement or non-standard settings. No network connectivity or remote access is required once the malicious application is installed. The local attack vector substantially limits exploitation to scenarios where attackers already have code execution capability through supply chain compromise, insider threats, or social engineering successful enough to convince users to install untrusted software. These prerequisites explain the low EPSS score despite high CVSS - exploitation requires overcoming significant platform security controls before reaching the vulnerable code path.

CVSS 7.8 (High) reflects significant technical impact (complete compromise of confidentiality, integrity, availability) but local attack vector with low-privileged user requirement substantially constrains exploitation scenarios. EPSS 0.02% (5th percentile) suggests minimal observed exploitation attempts in the wild, aligning with absence from CISA KEV catalog and no public proof-of-concept identified. SSVC decision framework considerations: Exploitation status is 'none' (no confirmed active use), automatable is 'no' (requires local application installation and execution), technical impact is 'total' (root access provides complete system control). The vulnerability requires an attacker to first execute code as an authenticated user, positioning this as a second-stage attack requiring initial compromise via social engineering, malicious app installation, or chaining with another vulnerability. Real-world risk is moderate for enterprise environments with strict application control policies but elevated for consumer devices with frequent third-party app installations. Apple's rapid coordinated patch across all platforms indicates vendor assessment of genuine risk despite low observed exploitation. Priority should be high for macOS systems running privileged workloads or accessible to multiple users, moderate for single-user consumer devices with standard patch cycles.

An attacker distributes a seemingly benign application through third-party channels or convinces a user to install malicious software through social engineering. Once installed and executed by the authenticated user, the malicious application exploits the authorization state management flaw to escalate privileges from standard user to root without triggering authentication prompts or user consent dialogs. With root access, the attacker deploys persistent backdoors, disables security controls like Gatekeeper or System Integrity Protection, exfiltrates sensitive data including credentials and encrypted files, or installs additional malware components with full system privileges that survive reboots and evade user-level detection.