iOS and iPadOS EUVD-2026-60511

The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms that exploitation requires a locally-installed application running with low user-level privileges on the device - no network access, no administrator rights, and no special device configuration are needed beyond the app being present and executing. The primary real-world limiting factor is the requirement for an attacker to deliver a malicious app to the target device, whether through the App Store, an enterprise certificate distribution channel, or physical access enabling direct installation via sideloading. This is not a remotely exploitable network-layer flaw. No specific iOS feature or non-default configuration setting is identified in the advisory as a prerequisite; the vulnerability appears to affect the kernel API surface available to all sandboxed apps running on affected iOS and iPadOS versions.

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a local, low-privileged, no-interaction attack with high confidentiality impact but no integrity or availability consequence, placing this in the medium severity band. EPSS data was not included in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified from this dataset. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, so the exploitation status is no public exploit identified at time of analysis. Despite the moderate composite score, the practical risk of kernel information disclosure is elevated because it is routinely chained with separate elevation-of-privilege bugs - even a mid-sized municipal IT team in bytom managing a fleet of corporate iOS devices should treat this as a meaningful stepping-stone risk rather than a routine low-priority patch. SSVC signals point to reduced urgency for most defenders given the absence of active exploitation and the local-only attack vector, but MDM-managed environments handling sensitive data should prioritize this update given how frequently this vulnerability class enables multi-stage iOS jailbreak or spyware chains.

An attacker publishes a malicious app - or trojans an existing utility - that, once installed and launched by the target user, invokes the vulnerable kernel interface to read sensitive kernel state such as KASLR slide values or kernel heap addresses. This data is exfiltrated to an attacker-controlled endpoint and used as a prerequisite input for a second-stage privilege escalation exploit targeting a distinct, separately-identified vulnerability, enabling a full device compromise chain.