EUVD-2026-77964
GHSA-wxc5-2jg8-734h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitation requires a locally installed/running app (AV:L), needs no special privileges (PR:N); fingerprinting exposes limited identifiers so C:L, with no integrity or availability impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to fingerprint the user.
AnalysisAI
User fingerprinting on Apple iOS and iPadOS devices running versions earlier than 26.6 allows an installed application to identify and track the device owner through sensitive data that Apple has now relocated as part of version 26.6. Per the authoritative assessment, this is an on-device, local-execution privacy flaw (CWE-359) with no additional privileges or user interaction required beyond the app running, and its impact is limited to tracking/fingerprinting rather than data theft, code execution, or system compromise; the supplied AV:N/high-confidentiality vector is not borne out by analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a malicious or privacy-abusing app to be installed and executed on the target iOS/iPadOS device (version below 26.6); this is on-device local execution, not remote network exploitation despite the supplied AV:N vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a privacy/fingerprinting flaw (CWE-359) in Apple iOS/iPadOS, fixed in 26.6, that Apple describes as 'An app may be able to fingerprint the user.' The signals conflict sharply. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to iOS 26.6 and iPadOS 26.6, which Apple states fixes the issue by moving sensitive data; the advisory is at https://support.apple.com/en-us/128066. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all iOS and iPadOS devices across managed, BYOD, and enterprise-provisioned fleets and identify every endpoint running a version earlier than 26.6; confirm that App Store, sideloading, MDM/enterprise provisioning, and TestFlight are the only application-install paths permitted in policy and review any existing allow-lists for privacy-abusive apps. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today