Apple iOS, macOS, visionOS, watchOS EUVD-2026-29282

Exploitation requires a malicious application to be installed and executed on the target device with standard user-level privileges. The app must be able to interact with the privacy preferences system on the specific platform (iOS, macOS, visionOS, or watchOS). No special OS configuration, feature toggles, or non-default settings are required; the vulnerability exists in the baseline privacy implementation. Exploitation is limited to local access (AV:L in CVSS vector), meaning remote network-based attacks are not possible. Additionally, successful data exfiltration depends on the device user having previously restricted app access via privacy settings; if a user has not configured privacy restrictions, the vulnerability provides no additional data access beyond normal app permissions.

Risk assessment reveals a significant disconnect between academic severity metrics and real-world exploitation likelihood. CVSS 5.5 (Medium) with AV:L/AC:L/PR:L indicates local, low-complexity attack by an already-authenticated app-a realistic but bounded threat model. However, EPSS score of 0.01% (2nd percentile) is exceptionally low, suggesting minimal real-world exploitation despite public disclosure. No CISA KEV status is listed, indicating no confirmed active exploitation. SSVC classification (Exploitation: none, Automatable: no, Technical Impact: partial) aligns with the low EPSS, categorizing this as a lower-priority vulnerability requiring local presence and offering only partial data exfiltration. The gap between CVSS and EPSS reflects Apple's strong software ecosystem enforcement-while technically feasible, attackers face deployment friction (requiring malicious app distribution through App Store or sideloading) and user trust barriers. Organizations running current OS versions face minimal real-world risk; priority should focus on standard patch cadence rather than emergency response.

A malicious app installed on an iOS device (either through social engineering via App Store or through sideloading on macOS) runs with user privileges and probes the privacy preferences system to discover which user-restricted permissions are accessible. The app then silently accesses data-such as contacts, location, or photos-that the user explicitly denied in Settings, exfiltrating the data without permission prompts or user notification. The attack succeeds because the privacy enforcement layer failed to validate the app's entitlements against the user's privacy configuration.