EUVD-2026-77927
GHSA-q556-6xx8-3479
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker publishes/sideloads malicious app
-
DeliveryUser installs and runs app
-
ExploitApp abuses state-management flaw
-
ExecutionEnumerate other installed apps
-
ImpactExfiltrate app-inventory for fingerprinting
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have a locally-installed, running app on the victim's Apple device (AV:L, PR:L) - i.e., the user must install and run the malicious app; there is no remote or network-only path and no elevated privilege is needed beyond a normal sandboxed app. The impact is bounded to disclosing the inventory of other installed apps (C:L, I:N/A:N), so it yields fingerprinting/privacy data rather than file or credential access. Limiting factors: requires code execution via an installed app (App Store review or sideloading gate), affects only pre-patch versions (iOS/iPadOS <26.7 or <27, macOS <15.8/<26.7/<27, tvOS/visionOS/watchOS <27), and delivers only low-sensitivity metadata. |
| Impact | This is a low-severity information-disclosure issue and should be treated as low priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 3.3) describes a locally-installed, low-privileged app that can enumerate which other apps a user has installed - a privacy/fingerprinting leak, not memory disclosure or credential theft, hence C:L and I:N/A:N. All exploitation signals reinforce the low rating: EPSS is 0.17% (7th percentile), there is no CISA KEV listing, and no public exploit code is referenced. There is no SSVC data provided. The signals are internally consistent - low CVSS, low EPSS, no KEV, no POC - so there is no conflict to reconcile. The one caveat is prevalence: because the affected products are Apple's consumer operating systems, the deployment footprint is enormous, but the per-instance impact is small and requires an attacker-controlled app already running on the device. Net: real but minor; patch in normal cadence rather than emergency. |
| Exploit ScenarioDerived | A user installs a seemingly benign app from the App Store or via sideloading; that app abuses the flaw to enumerate the list of other installed applications on the device. The attacker uses this to fingerprint the user, detect security/competitor apps, or target follow-on social-engineering. No public exploit code is identified, and the leak is limited to app-presence metadata (C:L), not user file contents. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Information disclosure in Apple iOS and iPadOS (versions before 26.7 and before 27) lets a locally installed app determine which other apps the user has installed, exposing a device-fingerprinting and privacy surface rather than files, credentials, or user data. The root cause is a state-management defect (CWE-200) that Apple fixed in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. Exploitation requires the victim to install and run a malicious sandboxed app on the target device (CVSS AV:L, PR:L), so there is no remote or unauthenticated path; no public exploit code has been identified at time of analysis, and EPSS is 0.17% (7th percentile), consistent with a low-severity, low-priority finding.
RemediationAI
Update to the vendor-released fixed versions: iOS 26.7 and iPadOS 26.7, or iOS 27 and iPadOS 27; macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27; and tvOS 27, visionOS 27, and watchOS 27. Apple documents the fixes in advisories https://support.apple.com/en-us/149034 through 149043 (see also the NVD record https://nvd.nist.gov/vuln/detail/CVE-2026-84626). Because exploitation requires a malicious app already installed and running on the device, the most effective compensating controls are app-installation controls: enforce App Store-only installation (blocks sideloaded or third-party-marketplace apps, but does not protect against a malicious app that passes review), remove or restrict Enterprise/Developer-signed app profiles via MDM (breaks legitimate internal app distribution), and revoke untrusted provisioning profiles and untrusted developer certificates on managed fleets (may disrupt developer workflows). Deploying updates promptly is preferred over workarounds, since no network-level or configuration mitigation closes the app-visibility leak on unpatched systems, and the issue carries only low confidentiality impact and a 0.17% EPSS score, so it should be scheduled as routine patch maintenance rather than an emergency response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and stems from insufficient state management around the interface that governs whether a sandboxed app may query the device's installed-application inventory. On Apple platforms, app-inventory visibility is supposed to be constrained by sandbox state and entitlement checks; the vendor's phrasing that the issue was 'addressed with improved state management' indicates that cached or stale state (for example, permission or container state that was not revalidated on a transition) allowed a normal app to read installation records it should not have been able to see. CPE data confirms the affected product families as apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, and apple:watchos, i.e. the shared multi-platform code path behind Apple's app-visibility APIs rather than a single OS. The impact is bounded to confidentiality of low-sensitivity metadata (installed-app inventory) with no integrity or availability effect, making this useful primarily for fingerprinting, targeted-ad or profiling abuse, or reconnaissance that supports follow-on attacks.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local malicious app with low privilege (AV:L/PR:L), no UI once running; leaks only installed-app inventory so C:L and I:N/A:N.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to identify what other apps a user has installed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB