CVE-2026-28963
iPhone Mirroring Visual Intelligence Data Exposure in iOS and iPadOS
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: Apple Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apple | ios | 26.5 |
| apple | ipados | 26.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a privacy issue in iOS and iPadOS where an attacker with physical access to the device could use a feature called Visual Intelligence during iPhone Mirroring to access sensitive user data.
The issue was addressed by removing the vulnerable code and is fixed in iOS 26.5 and iPadOS 26.5.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker with physical access to your iPhone or iPad to access sensitive user data through the Visual Intelligence feature during iPhone Mirroring.
This could lead to unauthorized disclosure of personal or confidential information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update your devices to iOS 26.5 or iPadOS 26.5 where the vulnerable code has been removed.
Additionally, since the vulnerability requires physical access, restrict physical access to your devices to trusted individuals only.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves a privacy issue where an attacker with physical access could use Visual Intelligence to access sensitive user data during iPhone Mirroring. Such unauthorized access to sensitive data could potentially lead to non-compliance with privacy regulations like GDPR and HIPAA, which require protection of personal and sensitive information.
The issue was addressed by removing the vulnerable code in iOS 26.5 and iPadOS 26.5, mitigating the risk of unauthorized data access.