Apple iOS EUVD-2026-78111

Requires a locally installed and executed application on the target device (iOS/iPadOS, tvOS, visionOS, or watchOS) that can invoke the affected identifier API before the state-management fix is applied; this is a sandbox/state-management isolation failure, not a remote or network-reachable flaw. The principal limiting factors are that exploitation depends on the user installing and running the malicious app (user interaction), that the leaked value is a persistent account identifier rather than credentials or memory contents, and that no POC or in-the-wild exploitation is known. The supplied CVSS vector claims AV:N/PR:N/UI:N, which contradicts the stated local-app requirement - defenders should assume local access with user interaction rather than remote unauthenticated access until the vendor clarifies.

Signals conflict and should be read carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) describes an unauthenticated network-reachable confidentiality loss, yet the CVE description explicitly requires 'a local app' - meaning AV should be Local and user interaction (install/launch of a malicious app) is realistically required. The high score therefore likely reflects a scoring template mismatch rather than a true remote exploit path. EPSS is 0.15% (5th percentile), there is no CISA KEV listing, and no public exploit code was identified, so real-world urgency is low. The impact that does apply - disclosure of a persistent account identifier - is a privacy/tracking concern with downstream abuse potential (cross-app correlation, targeted profiling) but no code execution, data modification, or availability impact. Priority should be routine patching during the next OS update, not emergency response.

An attacker distributes a seemingly benign app - via the App Store or an enterprise/sideloading channel - that, once the victim installs and launches it, queries the affected framework and reads a persistent account identifier that should have been inaccessible. The app then transmits the identifier to attacker-controlled infrastructure, enabling cross-app correlation, user profiling, or linkage to other data sets. No special privileges, exploit code, or network-facing service is required on the target device; the only barrier is convincing the user to install and run the app.