iOS
CVE-2025-46288
MEDIUM
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An app may be able to access sensitive payment tokens.
AnalysisAI
Local privilege escalation in Apple operating systems (iOS, iPadOS, macOS Tahoe, visionOS, watchOS) allows authenticated applications to bypass payment token access restrictions and obtain sensitive payment credentials. The vulnerability affects all versions prior to the 26.2 release across affected platforms. CVSS 5.5 with low real-world exploitation risk (EPSS 0.01%), no public exploit identified, not listed in CISA KEV.
Technical ContextAI
This vulnerability stems from a permissions enforcement failure (CWE-284: Improper Access Control) in Apple's multi-platform operating system payment security framework. The issue involves insufficient validation of application sandbox restrictions that protect sensitive payment tokens-cryptographic credentials used for financial transactions. The CVSS vector (AV:L, AC:L, PR:L) indicates the attack requires local access and authentication as an app with minimal user interaction, suggesting the flaw lies in the inter-process communication or file system access control mechanisms that gate payment token access. Affected CPE entries span iOS/iPhone OS, iPadOS, macOS, visionOS, and watchOS, indicating the vulnerability exists in a shared system component across Apple's entire operating system portfolio.
RemediationAI
Vendor-released patch: Apple operating system versions 26.2 or later for iOS, iPadOS, macOS Tahoe, visionOS, and watchOS. Users should update to these versions immediately via Settings > General > Software Update on iOS/iPadOS/visionOS/watchOS, or System Settings > General > Software Update on macOS. No interim workarounds are documented; the patch involves fundamental permission enforcement changes that cannot be mitigated at the application level. Installation is mandatory for all users to prevent malicious applications from extracting payment tokens. Full details available at https://support.apple.com/en-us/125884 and associated Apple security bulletins.
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Same weakness CWE-284 – Improper Access Control
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today