CVE-2026-28963

MEDIUM

iOS and iPadOS < 26.5 - Unauthorized Access to Sensitive User Data via Visual Intelligence

Title source: llm

Description

A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to use Visual Intelligence to access sensitive user data during iPhone Mirroring.

References (1)

Core 1

Core References

https://support.apple.com/en-us/127110

Scores

CVSS v3 4.6

EPSS 0.0002

EPSS Percentile 5.9%

Attack Vector PHYSICAL

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-359

Status published

Products (3)

Apple/iOS and iPadOS < 26.5

apple/ipados < 26.5

apple/iphone_os < 26.5

Published May 11, 2026

Tracked Since May 12, 2026