iOS and iPadOS EUVD-2026-29268

Requires victim installation and execution of a malicious application on an unpatched iOS 26.5, iPadOS 26.5, or visionOS 26.5 device. The CVSS vector indicates AV:N/AC:L/PR:N/UI:N, but the description context clarifies the actual prerequisite is local code execution through an installed app, not direct remote network exploitation. No special device configuration or feature enablement required beyond allowing the malicious app to run. Exploitation is limited by Apple's App Store review process for App Store distributed apps, though sideloading, TestFlight distribution, or enterprise signing certificates can bypass this control. User interaction (UI:N) suggests once the app is launched, no further user action is needed to access sensitive data. The vulnerability does not require administrative privileges, jailbroken devices, or developer mode enablement.

The CVSS score of 7.5 (High) reflects significant confidentiality impact (C:H), but real-world risk indicators tell a more nuanced story. The CVSS vector AV:N/AC:L/PR:N/UI:N suggests remote unauthenticated exploitation, which conflicts with the description stating 'an app may be able to access' - implying the attacker must first achieve code execution through a malicious application installation. This inconsistency suggests the CVSS vector may overstate the attack surface or the vulnerability may have multiple exploitation paths. The EPSS score of 0.02% (5th percentile) indicates minimal observed exploitation activity, suggesting this is not being actively targeted in the wild. No CISA KEV listing and no public POC availability further support low immediate exploitation risk. The vulnerability requires user installation of a malicious application, adding a social engineering barrier absent from the CVSS vector. For enterprise environments with MDM controls restricting app installation, risk is substantially lower. For consumer devices with unrestricted App Store or sideloading access, the information disclosure impact (accessing contacts, photos, health data without consent) represents moderate privacy risk but not system compromise. Priority should be medium for most organizations - patch during normal update cycles rather than emergency deployment.

An attacker develops a seemingly legitimate application (e.g., a photo editing app or fitness tracker) and distributes it through the App Store or third-party channels. When a user installs and launches the application, it exploits the UI state management flaw to access sensitive user data such as contacts, photos, location history, or health records without triggering proper permission prompts or bypassing previously denied permissions. The application exfiltrates this data to attacker-controlled servers while presenting a normal user interface, giving no indication of unauthorized access. No public proof-of-concept exists at time of analysis, but the low attack complexity (AC:L) suggests exploitation does not require sophisticated techniques once the malicious app is installed.