Apple iOS EUVD-2026-78094

Exploitation requires a malicious or untrusted app already installed and running on an affected Apple device running a version of iOS/iPadOS, macOS Golden Gate, tvOS, visionOS or watchOS below 27 - the vulnerability lives in the Bluetooth authorization state, so any app capable of requesting Bluetooth access (or holding a stale/revoked grant) is the delivery vehicle. No user interaction is required once the app is present (UI:N), and the attacker operates at app-level privilege (PR:L) rather than as root. What limits real-world risk: it is not remotely reachable (AV:L), there is no confirmed companion vulnerability that installs the app for the attacker, exploitation depends on App Store review or MDM policy allowing the app onto the device at all, and the impact is bounded - confidentiality is only partially affected while availability is untouched. Devices already upgraded to version 27 or later are not affected.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, 6.1) describes a local, low-complexity attack that requires an attacker to already hold low-privileged execution on the device - realistically a malicious or trojanized app - with no user interaction beyond having that app present; confidentiality impact is limited (C:L) while integrity impact is high (I:H), consistent with an app being able to manipulate Bluetooth state and connected peripherals rather than exfiltrate arbitrary data. EPSS of 0.20% (10th percentile) indicates the community sees essentially no likelihood of exploitation in the next 30 days, there is no CISA KEV listing, and no public exploit code has been identified, so this is a low-urgency, defense-in-depth patch even though the raw score sits in the medium band - even a mid-sized municipal IT team in mielec should treat this as a routine update cycle item rather than a break-glass incident. Note the tension between the CVSS PR:L metric and the fact that the attacker must first get an app onto the device (App Store review, MDM policy, or sideloading); Apple's advisory does not describe a remote or pre-authentication path. No EPSS/KEV conflict exists here: all signals point the same direction. What is missing is a vendor-provided CVSS score in the reference set and any detail on how reliably the authorization state can be induced into the flawed condition.

A user installs an app that either was never granted Bluetooth access or whose Bluetooth permission was subsequently revoked; due to the faulty authorization state management, the app continues to reach the Bluetooth stack anyway. The app then scans for and interacts with paired peripherals, quietly changing state on connected devices (I:H) or harvesting limited data about nearby and bonded devices (C:L). The attack requires the victim to have that app installed and needs no further interaction, but it is entirely local in scope and no working public exploit has surfaced.