iOS and iPadOS EUVD-2026-78009

Requires physical possession of the target device while it is in a LOCKED state; the attacker interacts with a lockscreen-reachable feature to bypass an authentication/authorization check (CWE-287) and view sensitive data without entering the passcode. Exploitation is fundamentally limited by the need for hands-on physical access (AV:P) - it cannot be performed remotely or at scale - and is fully mitigated by updating to iOS/iPadOS 26.7 or 27. Impact is confidentiality-only (no modification or denial of service).

Signals are consistent and point to a LOW-to-MEDIUM real-world priority. The CVSS vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 4.6) requires PHYSICAL access to a locked device - the single most limiting factor - which caps the score despite the C:H confidentiality claim. EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so this is not an at-scale threat. The one point of tension is C:H: the description only says 'view sensitive user information' without specifying scope, so C:H may be generous - a more conservative C:L would put this near 3.9; verify the actual data exposed against Apple's advisory. There is no conflict between CVSS and the description (both indicate local physical access, unauthenticated against the lockscreen). Overall this is a genuine but hands-on-device weakness relevant to targeted/opportunistic scenarios (lost, stolen, or briefly unattended devices), not remote mass exploitation.

An attacker who gains brief physical possession of a locked iPhone or iPad (e.g., a lost, stolen, or momentarily unattended device) manipulates a lockscreen-accessible feature to reveal sensitive user data without unlocking. No exploit code is publicly identified, and success depends on hands-on interaction with the specific device rather than any remote or automated vector.