iOS and iPadOS EUVD-2026-65740

Exploitation requires a malicious application to be installed and executed on the target device - the attack vector is strictly local (AV:L) and requires at least low-privilege app execution (PR:L). The victim must install the malicious app, whether through social engineering, a compromised developer account, enterprise provisioning abuse, or sideloading. No non-default configuration or specific feature enablement is required beyond the app being installed. Exploitation is limited by Apple's App Store review process for standard distribution channels, the requirement for physical or social-engineering access to induce installation, and the fact that the attack is not automatable (SSVC: Automatable: no). The impact is restricted to confidentiality of the installed app list - no code execution, no data modification.

The CVSS base score of 3.3 (Low) is well-supported by the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N: the attack is local (malicious app must be installed), requires low privileges (standard app execution), and the impact is limited to partial confidentiality loss with no integrity or availability consequences. EPSS at 0.09% (0th percentile) confirms near-zero observed exploitation probability. SSVC signals further corroborate low urgency: Exploitation: none, Automatable: no, Technical Impact: partial. There is no CISA KEV entry and no public exploit identified. The primary real-world risk is privacy-based - app enumeration can reveal sensitive installed apps (banking, health, security tools) and enable targeted social engineering or follow-on attacks, but this requires the attacker to already have an app installed on the target device. This is a genuine but low-priority issue.

An attacker distributes a malicious application through a sideloading mechanism or a compromised developer account. Once the app is installed and launched on the victim's device, it queries the app enumeration interface to compile a list of installed applications. This list is exfiltrated, revealing the presence of banking apps, corporate VPN clients, or security tools, enabling targeted phishing or credential theft campaigns.