EUVD-2026-49607
GHSA-qmfh-v5vm-w2qv
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Requires local app execution and user interaction, so AV:L and UI:R; no privileges needed, so PR:N.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
This issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6. An app may be able to access information about a user's contacts.
AnalysisAI
Information disclosure in Apple iOS, iPadOS, and macOS Tahoe allows a malicious app with local access to read a user's contacts database. The flaw is fixed in iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6. No public exploit or active exploitation has been reported, and the EPSS score (0.15%) indicates low exploitation likelihood.
Technical ContextAI
The vulnerability resides in the contacts database access controls on Apple operating systems (iOS, iPadOS, macOS Tahoe). Classified as CWE-200 (Exposure of Sensitive Information), the root cause is improper validation of app-level access to the user's address book. Affected versions include iOS and iPadOS versions prior to 26.6 and macOS Tahoe versions prior to 26.6, as indicated by the CPE strings cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos. The attack surface is local, requiring an app to execute on the device.
RemediationAI
Update to the patched versions: iOS 26.6, iPadOS 26.6, or macOS Tahoe 26.6. No workarounds are available; the primary mitigation is to install the vendor-released updates. Adhere to best practices by only installing trusted apps from the official App Store. Advisory links: https://support.apple.com/en-us/128066 (iOS/iPadOS) and https://support.apple.com/en-us/128067 (macOS).
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today