EUVD-2026-78023
GHSA-vc5f-rf8j-r9hh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker gets malicious app onto device
-
ExploitApp reads unredacted system/app logs
-
ExecutionExtract sensitive user data
-
ImpactExfiltrate confidential information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Log data sanitization
|
| Exploitation Conditions | Requires a malicious or privacy-abusing app to be installed and running locally on an affected Apple device (iOS/iPadOS <27, macOS Sequoia <15.8 / Tahoe <26.7 / Golden Gate <27, tvOS/visionOS/watchOS <27); the app then reads sensitive user data that was written to logs without adequate redaction. Exploitation is limited by the local attack vector (AV:L) - no remote or network path - and by the need to first deliver an app onto the device; impact is confidentiality only, with no code execution, integrity, or availability effect. Note the vector lists UI:R, implying some user interaction, though the description does not specify what triggers it. |
| Impact | This is a genuine-but-low-priority information-disclosure issue, not a high-urgency threat. Signals are consistent: CVSS 5.5 (medium) with AV:L (local vector - no remote exploitation), C:H but I:N/A:N (confidentiality-only impact), EPSS 0.18% (7th percentile - very low probability of exploitation), no CISA KEV listing, and no public POC. The exploitation status is 'no public exploit identified at time of analysis.' There is one internal inconsistency worth flagging: the CVSS vector states PR:N (no privileges) with UI:R (user interaction required), yet the description says 'an app may be able to access sensitive user data,' which implies a locally installed/running app rather than a truly unauthenticated actor requiring user interaction - the PR/UI combination is atypical for an on-device log-redaction flaw and should be verified with Apple. Because the flaw is CWE-532 (sensitive data in logs) reachable only by a local app, real-world risk is gated by an attacker first getting a malicious app onto the device, and impact is limited to reading data already logged. A patch is available across all affected Apple OSes, so remediation is straightforward via normal OS updates. |
| Exploit ScenarioDerived | A malicious or overly curious app installed on an Apple device reads system or application logs that contain insufficiently redacted sensitive user data, exfiltrating it without needing elevated privileges. No public exploit code exists, and the local attack vector means the attacker must already have code running on the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Locally installed apps on unpatched Apple platforms (iOS and iPadOS before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27) can read sensitive user data that the system wrote into logs without adequate redaction. Apple fixed the flaw by improving data redaction in the release train listed in its security advisories. Impact is confidentiality-only and strictly local, with no network attack path, and a low EPSS of 0.18% (7th percentile) reflects that; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. One prerequisite discrepancy is worth noting: the published vector requires user interaction (UI:R), while our assessed vector treats the app as already installed and running without interaction.
RemediationAI
Vendor-released patch: update to iOS 27 and iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, per the Apple advisories at https://support.apple.com/en-us/149034, 149035, 149036, 149037, 149038, 149042 and 149043; the backport to macOS Sequoia 15.8 means devices that cannot move to the 27.x line still have a supported fix. If patching must be deferred, compensate by restricting which apps can be installed and executed: enforce App Store-only or MDM-managed app allowlists, disable developer mode and unmanaged enterprise/sideloaded app installation, and remove untrusted configuration profiles, accepting the trade-off of reduced flexibility for internal development and app distribution. Shrink the exposure window by turning off sharing of analytics and diagnostics with third-party or developer services and by tightening retention and deletion of diagnostic and sysdiagnose bundles, at the cost of less telemetry available to vendor support. Because the leaked data may already have been written to logs, rotate any credentials, tokens, or personal data that could plausibly have been logged, and audit local log access where the platform permits it. A fix exists for every affected platform and no public exploit has been identified, so this can be handled in a normal patch cycle rather than an emergency one.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-532, Insertion of Sensitive Information into Log File. Apple platforms emit diagnostics through the unified logging system (os_log/OSLog), where interpolated values are private and redacted by default unless a developer explicitly marks them public; this CVE covers log statements that leaked user data without that redaction, so the resulting records remain readable to other local code. The exposure surface extends beyond the live log stream to persisted log archives, crash and diagnostic reports, and sysdiagnose bundles, which is why the fix is described as improved data redaction rather than a code-execution patch. CPE data maps the affected components to cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:tvos, cpe:2.3:a:apple:visionos and cpe:2.3:a:apple:watchos, confirming a platform-wide remediation rather than a fix to a single bundled app or service. There is no memory-safety bug, no code execution, and no integrity or availability impact (C:H, I:N, A:N); our assessed vector (AV:L/AC:L/PR:L/UI:N) describes a locally installed, low-privilege app already running on the device, whereas the published CVE vector lists PR:N/UI:R, so authentication and user-interaction requirements are not fully confirmed from the available data.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
A locally installed app reads unredacted sensitive log data, so AV:L and PR:L (app must run on device); confidentiality-only (C:H, I:N, A:N); I assess PR:L/UI:N rather than the advisory's PR:N/UI:R.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB