EUVD-2026-49627
GHSA-9494-q35c-mv5p
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local attack via a malicious app with no privileges needed; user must launch the app; only confidentiality is impacted.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to access sensitive user data.
AnalysisAI
Information disclosure in iOS and iPadOS versions before 26.6 allows a locally installed malicious application to access sensitive user data without proper authorization. Apple addressed the flaw in iOS 26.6 and iPadOS 26.6 with improved state management; no active exploitation or public proof-of-concept has been identified. The EPSS exploitation probability is low (0.14%), consistent with the local attack vector and required user interaction.
Technical ContextAI
The vulnerability resides in the operating system's state management for app authorization and is classified as CWE-200 (Exposure of Sensitive Information). The affected product, as indicated by the CPE string 'cpe:2.3:a:apple:ios_and_ipados', encompasses all iOS and iPadOS releases prior to the fix. The issue likely involves improper handling of app state transitions or permission checks, enabling an app to read data it should not normally access.
RemediationAI
Update to iOS 26.6 or iPadOS 26.6 as specified in Apple's advisory (https://support.apple.com/en-us/128066). No workarounds are documented. Users should refrain from sideloading untrusted apps or installing enterprise profiles from unknown sources until the update is applied, as these bypass App Store review.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today