EUVD-2026-49506
GHSA-6w9m-748q-qh2w
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Physical access required; no authentication; only confidentiality affected.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
This issue was addressed through improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6. An attacker with physical access may be able to access sensitive user data during iPhone Mirroring.
AnalysisAI
Physical access to an iPhone or iPad running vulnerable iOS/iPadOS versions allows an attacker to access sensitive user data during the iPhone Mirroring feature due to improper state management. This issue is fixed in iOS 26.6 and iPadOS 26.6. No known exploitation in the wild; EPSS score is low (0.15%, percentile 5%).
Technical ContextAI
iPhone Mirroring is a feature that allows a user to mirror their iPhone screen to a Mac or another device, typically for remote control or content sharing. The vulnerability (CWE-284: Improper Access Control) arises from flawed state management during the mirroring session, where the system fails to enforce proper access controls when the mirrored device is physically interacted with. According to the CPE, the affected products are Apple iOS and iPadOS versions prior to 26.6, encompassing a wide range of iPhone and iPad models.
RemediationAI
Update to iOS 26.6 or iPadOS 26.6, which contains the fix. The update can be obtained through the device's Settings > General > Software Update. No workarounds have been disclosed, but as a compensating control, ensure that devices are not left unattended while iPhone Mirroring is active, and consider disabling the mirroring feature when not in use. Apply the patch to all affected devices as soon as possible. Refer to Apple's advisory at https://support.apple.com/en-us/128066.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today