EUVD-2026-49431
GHSA-84vx-j768-rcxx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
DeliveryUser opens the app
-
ExploitApp bypasses entitlement checks
-
ExecutionApp accesses sensitive user data
-
ImpactData exfiltration via file or network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have an app installed on the victim's device, and the app must be opened by the user (user interaction required). The vulnerability is exploitable only locally (AV:L) - no network exploitation is possible. No authentication is required (PR:N), but the local access and user interaction limit the attack surface. The vulnerability affects default configurations of iOS/iPadOS and macOS. |
| Impact | CVSS base score 5.5 (Medium) indicates limited risk due to local attack vector, low complexity, and requirement for user interaction. EPSS score is 0.16% (low exploitation probability), and there is no CISA KEV listing or public exploit code. The vulnerability is a moderate priority for environments where untrusted apps are installed on user devices, but the low EPSS and lack of active exploitation suggest it is not an urgent threat. No conflicting signals exist; the data is consistent with a locally exploitable information disclosure. |
| Exploit ScenarioDerived | An attacker distributes a malicious app through the App Store or via sideloading. Once installed, the user inadvertently opens the app, which then exploits the missing entitlement checks to read sensitive data such as contacts or messages from the device's storage. No public exploit code is known at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Local information disclosure in Apple iOS and iPadOS 26.6 and earlier, as well as multiple macOS versions, allows an app to leak sensitive user data due to missing entitlement checks. The vulnerability requires user interaction and local access, but has low exploitation probability (EPSS 0.16%) and no known public exploits or active exploitation per CISA KEV.
RemediationAI
Apply the vendor-released patches: update iOS and iPadOS to version 26.6, macOS Sequoia to 15.7.8, macOS Sonoma to 14.8.8, and macOS Tahoe to 26.6. No workarounds are documented; installing the updates is the sole remediation. Advisory links: https://support.apple.com/en-us/128066 (iOS/iPadOS), https://support.apple.com/en-us/128067 (macOS Sequoia), https://support.apple.com/en-us/128071 (macOS Sonoma), https://support.apple.com/en-us/128072 (macOS Tahoe).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper authorization (CWE-285) in Apple's entitlement system, which normally enforces sandbox restrictions and permission controls for apps. CPE data confirms affected products include iOS/iPadOS (versions below 26.6) and macOS (Sequoia <15.7.8, Sonoma <14.8.8, Tahoe <26.6). An app lacking proper entitlements can bypass checks and access sensitive user information that should be protected.
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local access, low complexity, user interaction required, high confidentiality impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to leak sensitive user information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB