EUVD-2026-77980
GHSA-j99f-48vv-pxmr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick user into installing malicious app
-
DeliveryUser launches the app
-
ExploitApp submits crafted traversal path
-
ExecutionBypass path validation
-
ImpactWrite to protected filesystem location
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a malicious or compromised app to be installed and launched on the target device (UI:R, AV:L); the flawed path validation is then reachable from within the app sandbox with no additional privileges (PR:N). Limiting factors: the attacker must first get their app onto the device and have the user run it, the flaw only enables integrity impact (filesystem writes to protected areas), not data theft or crashes, and it is remediated in iOS/iPadOS 26.7, iOS/iPadOS 27, and visionOS 27 - patched devices are not exposed. |
| Impact | This is a genuine but moderate-severity local-integrity flaw, not a network-exploitable emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, base 5.5) is internally consistent with the description: exploitation requires an app already running on the device (AV:L), the flaw lets it write outside its sandbox to modify protected filesystem locations (I:H) but yields no data disclosure (C:N) and no availability impact (A:N). The PR:N is technically correct in Apple's model - an ordinary app needs no elevated privilege - but the practical prerequisite is that the user install and run a malicious or compromised app (UI:R), which sharply limits real-world reach. Corroborating signals are low-urgency: EPSS is 0.17% (6th percentile), there is no CISA KEV listing, and no public POC is referenced. A vendor patch is confirmed available (Apple support advisories 149034/149038/149041). Net: a legitimately patch-worthy path-traversal sandbox escape, but a routine mobile-OS hardening fix rather than an actively exploited priority. No signals conflict; the only nuance is that PR:N understates the real dependency on delivering an app to the victim. |
| Exploit ScenarioDerived | An attacker publishes or trojanizes an app that a victim installs and launches; the app crafts filenames with traversal sequences that bypass path validation to write into protected parts of the filesystem outside its sandbox, corrupting or planting files to alter device behavior. No public exploit code is referenced, and exploitation depends on the user running the malicious app (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
A malicious or compromised app running on iOS and iPadOS prior to 26.7 (and prior to 27), and on visionOS prior to 27, can abuse insufficient path validation to write to protected parts of the file system. Apple addressed the path handling flaw with improved validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27, so patched devices are not exposed. Scoring 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), the issue requires the user to install and launch a hostile app but then needs no additional privileges; EPSS is only 0.17% (6th percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, so this is a moderate local-integrity flaw rather than a network-exploitable emergency.
RemediationAI
Apply the vendor-released patch: update iPhone and iPad devices to iOS 26.7 or iPadOS 26.7, or to the iOS 27 / iPadOS 27 release, and update Apple Vision Pro to visionOS 27; devices already on these builds are not exposed. See Apple's advisories at https://support.apple.com/en-us/149034, https://support.apple.com/en-us/149038, and https://support.apple.com/en-us/149041 for the per-platform fix listings. Because the flaw is a platform-level path validation defect reachable only from an installed, launched app, there is no configuration toggle that closes it: interim compensating controls are limited to reducing the attack surface that delivers the malicious app, such as restricting installs to trusted sources, enforcing an MDM-managed allowlist of permitted applications, and disabling sideloading/enterprise app installation profiles on managed fleets - each of which trades user/developer flexibility for reduced exposure and none of which removes the underlying bug, so updating remains the only complete fix. Note that the impact is integrity-only (protected file system writes, no reported data exfiltration or crash), which can inform prioritization, and there is no vendor patch data indicating a fixed version beyond the three releases above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal), arising from path handling logic in Apple's iOS/iPadOS/visionOS platforms that failed to fully validate file system paths before acting on them. Because the flaw sits inside the platform file system layer rather than in a network-facing service, the CVSS vector is local (AV:L) and requires user interaction (UI:R) - the attacker must deliver an app to the device and persuade the user to run it - but no privileges are needed once the app executes (PR:N), meaning the app sandbox does not contain the malformed path. The resulting impact is integrity-only (C:N/I:H/A:N): an app can modify protected parts of the file system, but there is no reported confidentiality loss (no data theft) or availability loss (no crash/DoS). CPE data restricts affected platforms to apple:ios_and_ipados and apple:visionos, matching the three Apple security advisories referenced (support.apple.com/en-us/149034, 149038, 149041) and ENISA EUVD-2026-77980.
Know when Visionos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Local because a malicious app must run on-device (AV:L, UI:R); no privilege needed within sandbox (PR:N); grants protected filesystem writes (I:H) with no disclosure or availability loss (C:N/A:N).
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to modify protected parts of the file system.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerabi
A denial of service vulnerability in This (CVSS 4.2). Risk factors: actively exploited (KEV-listed).
A logic issue was addressed with improved state management. Rated critical severity (CVSS 9.8), this vulnerability is re
An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab
Exploit-DB