EUVD-2026-49514
GHSA-6cg3-f6xf-3qv2
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Physical access required (AV:P), low complexity, no privileges, no user interaction, high confidentiality impact only.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information.
AnalysisAI
Physical access to a locked Apple device running vulnerable iOS or macOS allows an attacker to view sensitive user information due to an out-of-bounds read. The flaw is fixed in iOS 26.6, iPadOS 26.6, and multiple macOS versions. No public exploit or active exploitation has been reported.
Technical ContextAI
The vulnerability is an out-of-bounds read (CWE-125) in Apple's operating systems - iOS, iPadOS, and macOS - where improper bounds checking allows a physically present attacker to read beyond allocated memory buffers. Affected products per CPE include all versions of iOS and iPadOS before 26.6 and macOS before 15.7.8 (Sequoia), 14.8.8 (Sonoma), and 26.6 (Tahoe). This class of memory corruption typically occurs when handling specially crafted input during locked-device interactions.
RemediationAI
Update to iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6 as provided by Apple via Software Update. No workarounds are available; mitigating physical access (e.g., strong passcodes, enabling Find My, avoiding unattended devices) reduces exposure but does not patch the vulnerability.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today