Apple Keychain EUVD-2026-78103

Requires a malicious or compromised application to be installed and running on the target Apple device, which matches the CVSS vector's local attack vector and low privileges (AV:L/PR:L) with no user interaction beyond the app executing (UI:N). No special system configuration, network exposure, or elevated privilege is described by Apple; the flaw is in the default Keychain access-control behavior of the affected OS versions. Limiting factors: the attacker cannot read credentials (C:N in the vector), only delete items they should not be able to touch (I:H), so impact is integrity/disruption rather than disclosure; in practice the attack is bounded by the app sandbox and the need to get the app past Apple's review/notarization or onto the device via sideloading or enterprise distribution.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) describes a low-complexity, local, low-privilege attack with no user interaction beyond having the malicious app running, and impact limited to integrity - Keychain entries can be deleted but not read (C:N) and the system is not taken down (A:N). EPSS is only 0.15% (5th percentile) and the CVE is not in CISA KEV, and no public exploit code is known, so real-world exploitation pressure is currently low and this looks like a targeted/local-abuse or privacy-harassment issue rather than a mass-exploitation candidate. Note the score reflects a local attack vector, so remote/network exposure should not be assumed despite the broad platform list; the practical risk is concentrated in malicious or compromised apps already installed on the device.

An attacker distributes a seemingly benign app that, once installed and launched on a vulnerable iOS, macOS, or visionOS device, calls the Keychain API in a way the flawed access control does not block. The app deletes credentials belonging to other applications, forcing those apps to log out or lose stored secrets, degrading availability of dependent services and disrupting the user. Exploitation requires local installation and execution of the malicious app (per the AV:L/PR:L vector); no public exploit code is known at time of analysis.