Apple iOS EUVD-2026-77891

Requires a malicious or compromised app already installed and running on the affected device (AV:L, PR:L) on a version prior to iOS/iPadOS 27, tvOS 27, visionOS 27, or watchOS 27. No user interaction beyond running the app (UI:N), and no network exposure. macOS is explicitly not listed as affected. Exploitation is limited by Apple's app distribution, sandboxing, and code-signing controls, which raise the bar for getting hostile code onto the device in the first place; there is no remote or unauthenticated path.

This is a genuinely low-priority issue despite the medium 5.5 CVSS. The vendor vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is internally consistent with the description: a locally-installed app (AV:L, PR:L) accesses sensitive user data with no integrity or availability impact (confidentiality-only). All exploitation signals point down: EPSS is 0.16% (6th percentile), there is no CISA KEV listing, and no public POC is identified. There is no conflict between the CVSS vector and the description - both describe a local, low-privilege, on-device app reaching data it should not. The real limiting factor is the delivery gate: an attacker must first get a malicious or compromised app running on the victim's device, which on Apple's sandboxed/notarized platforms is a meaningful barrier. Net: real but low urgency - patch in the normal Apple OS update cycle, not an emergency.

A user installs a malicious or over-privileged app from a sideloaded source or the App Store. Because of an authorization/state-management flaw, that app bypasses the intended access checks and reads sensitive user data (e.g., data belonging to other apps or the user's private information) without a prompt or entitlement it should require. Exploitation is entirely local; no public exploit code is known.