Apple iOS/iPadOS EUVD-2026-40190

Exploitation requires a malicious app to be installed and actively launched by the user on an affected Apple device running iOS/iPadOS or macOS prior to the 26.5.2 fixes - the UI:R component confirms this user-interaction prerequisite. The app does not require elevated system privileges (PR:N), meaning any sandboxed App Store or sideloaded application can trigger the flaw. Exploitation is limited to local access (AV:L): there is no remote code path, so network-only adversaries cannot exploit this directly. The flaw is further constrained to information disclosure only (C:H, I:N, A:N) - an attacker cannot write kernel memory or crash the system through this path alone. Non-default configurations are not required; the vulnerable behavior is present in standard iOS/iPadOS and macOS installations. The practical limiting factor is the requirement for the user to install and run an attacker-controlled app.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 5.5 (Medium), reflecting a local attack with high confidentiality impact but no integrity or availability consequence. The UI:R component is notable: exploitation requires the user to actively run a malicious app, limiting drive-by attack paths. EPSS at 0.19% (9th percentile) reinforces that exploitation is not currently observed in the wild at scale. SSVC classifies exploitation as 'none', automatable as 'no', and technical impact as 'partial' - all signals pointing to a low operational priority unless threat models include sophisticated local adversaries or targeted device compromise. The real-world risk is moderate: while kernel state leaks are valuable as exploit primitives in chained attacks (e.g., paired with a separate code execution bug), this vulnerability alone provides only information disclosure and does not by itself enable takeover. The absence of a KEV listing and low EPSS are consistent with each other; no conflicting signals are present in the available data.

An attacker publishes a malicious app - distributed through a sideloading mechanism, enterprise provisioning profile, or a compromised App Store submission - that submits crafted input to a vulnerable kernel interface. When the user opens the app, it reads back sensitive kernel state data (such as kernel object addresses or layout information), which could be used as a building block in a multi-stage local privilege escalation chain targeting iOS or macOS. No public proof-of-concept code has been identified at time of analysis.