What is the CVSS score of CVE-2025-46276?

CVE-2025-46276 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

iOS CVE-2025-46276

MEDIUM

2025-12-12 product-security@apple.com

Apple iOS Information Disclosure

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Dec 12, 2025 - 21:15 nvd

MEDIUM 5.5

DescriptionCVE.org

An information disclosure issue was addressed with improved privacy controls. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An app may be able to access sensitive user data.

AnalysisAI

Local apps can access sensitive user data through improved privacy controls in Apple operating systems across iOS, iPadOS, macOS, visionOS, and watchOS. The vulnerability requires local network access and an authenticated user session (PR:L), limiting exposure to installed applications with explicit permissions. Confirmed patches are available across all affected platforms, and exploitation probability is very low (EPSS 0.02%), indicating this is a privacy-boundary issue rather than a critical security flaw.

Technical ContextAI

This vulnerability represents an information disclosure issue in Apple's privacy control mechanisms that govern how applications access sensitive user data. The attack vector is local (AV:L) with low complexity (AC:L), meaning a locally installed or running application can bypass or circumvent Apple's privacy guardrails without user interaction required once the app has obtained the necessary permissions. The issue affects the core operating system privacy framework across Apple's entire ecosystem (iOS, iPadOS, macOS variants including Sequoia, Sonoma, and Tahoe, plus visionOS and watchOS), suggesting a systemic privacy control weakness rather than an isolated feature bug. The confidentiality impact is high (C:H) while integrity and availability are unaffected, confirming this as a read-only data leakage vector. CWE classification is not provided, but this likely falls under improper access control or privilege boundary enforcement.

RemediationAI

Vendor-released patches are available for all affected platforms: install iOS 18.7.3 or later on iPhones, iPadOS 18.7.3 or later on iPads, macOS 15.7.3 on Sequoia systems, macOS 14.8.3 on Sonoma systems, macOS Tahoe 26.2 on compatible Apple Silicon Macs, visionOS 26.2 on Vision Pro devices, and watchOS 26.2 on Apple Watches. Apply updates via System Settings / System Preferences (Software Update) on affected devices. For enterprise deployments, use Mobile Device Management (MDM) or Managed Software Updates to enforce deployment. Review app permissions on devices with sensitive personal or healthcare data, and consider restricting access permissions for apps that do not require sensitive data access. Refer to Apple's official security advisories at the referenced support URLs for platform-specific update procedures.