CVE-2026-28963
Received Received - Intake
iPhone Mirroring Visual Intelligence Data Exposure in iOS and iPadOS

Publication date: 2026-05-11

Last updated on: 2026-05-11

Assigner: Apple Inc.

Description
A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to use Visual Intelligence to access sensitive user data during iPhone Mirroring.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-11
Last Modified
2026-05-11
Generated
2026-06-21
AI Q&A
2026-05-12
EPSS Evaluated
2026-06-20
NVD
CVE-2026-28963
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
apple ios 26.5
apple ipados 26.5
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a privacy issue in iOS and iPadOS where an attacker with physical access to the device could use a feature called Visual Intelligence during iPhone Mirroring to access sensitive user data.

The issue was addressed by removing the vulnerable code and is fixed in iOS 26.5 and iPadOS 26.5.

Impact Analysis

If exploited, this vulnerability could allow an attacker with physical access to your iPhone or iPad to access sensitive user data through the Visual Intelligence feature during iPhone Mirroring.

This could lead to unauthorized disclosure of personal or confidential information.

Mitigation Strategies

To mitigate this vulnerability, update your devices to iOS 26.5 or iPadOS 26.5 where the vulnerable code has been removed.

Additionally, since the vulnerability requires physical access, restrict physical access to your devices to trusted individuals only.

Compliance Impact

This vulnerability involves a privacy issue where an attacker with physical access could use Visual Intelligence to access sensitive user data during iPhone Mirroring. Such unauthorized access to sensitive data could potentially lead to non-compliance with privacy regulations like GDPR and HIPAA, which require protection of personal and sensitive information.

The issue was addressed by removing the vulnerable code in iOS 26.5 and iPadOS 26.5, mitigating the risk of unauthorized data access.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28963. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart