iOS and iPadOS EUVD-2026-49506

The attacker must have physical access to the iPhone or iPad while the device is actively participating in an iPhone Mirroring session (i.e., the mirroring feature is enabled and connected to another device). No authentication or user interaction is required beyond the pre-existing mirroring session. The device must be running a vulnerable version of iOS/iPadOS (<26.6). The requirement for physical access and an active mirroring session limits exploitation to scenarios where the device is physically accessible and the feature is in use.

The CVSS base score is 4.6 (Medium) with vector AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating that physical access is required, exploitation is easy, and only confidentiality is impacted. The EPSS score of 0.15% suggests a very low probability of exploitation in the near term. No CISA KEV inclusion or public exploit code is noted, so the vulnerability is likely not actively exploited. Although the confidentiality impact is high, the requirement for physical possession of the device and an active mirroring session significantly limits real-world risk. This is a moderate-priority issue for environments where devices are exposed to untrusted physical access during mirroring.

An attacker with physical access to an unattended iPhone that is actively engaged in an iPhone Mirroring session (e.g., while the user is using the feature on a nearby Mac) could exploit the state management flaw to view sensitive user data displayed on the mirrored screen or within the device's interface. No public exploit code exists, but the attack is straightforward due to low complexity.