EUVD-2026-77984
GHSA-6q49-jwhx-rp35
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick user into installing malicious app
-
DeliveryLaunch app with user interaction
-
ExploitAbuse permissions gap to bypass access restrictions
-
ExecutionRead sensitive user data
-
ImpactExfiltrate collected data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a malicious or compromised app already running locally on the device (AV:L, PR:N but app-delivered) plus user interaction (UI:R) - most realistically the user installing and opening the offending app. There is no remote or network-based path. Exploitation is limited by Apple's App Store review and application sandbox, and it is fully remediated by updating to iOS 27 / iPadOS 27; devices on earlier versions (0 <27) are affected. Impact is confined to disclosure of sensitive user data - no integrity or availability effect. |
| Impact | This is a genuine but low-urgency issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5 Medium) confirms LOCAL attack vector - exploitation requires code already executing on the device (a malicious or compromised app), not a remote network attacker. Impact is confidentiality-only (C:H, I:N, A:N): unauthorized access to sensitive user data, consistent with CWE-200 and the 'Information Disclosure' tag. Corroborating signals point to low real-world risk: EPSS is 0.17% (7th percentile), there is no CISA KEV listing, and no public exploit has been identified. Note a nuance in the vector: PR:N with UI:R means no elevated privileges are needed but the malicious app is the delivery vehicle and some user interaction is involved - the practical precondition is that the user has installed the offending app (App Store vetting and sandboxing normally mitigate this). No SSVC framework data was provided. Overall this is a real, vendor-confirmed permissions/sandbox weakness worth patching via routine OS update, not an emergency; nothing in the data indicates active or widespread exploitation. |
| Exploit ScenarioDerived | A user installs a seemingly benign app that abuses a permissions gap to reach sensitive user data it should not be able to read (per the local vector and UI:R). Because the attack requires local app execution rather than remote access, exploitation depends on getting a malicious app onto the device and the user interacting with it. No public exploit code has been identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Information disclosure in Apple iOS and iPadOS versions before 27 allows a locally installed malicious or compromised app to access sensitive user data after the user installs and opens it. The flaw is a permissions issue (CWE-200) that Apple addressed with additional restrictions in iOS 27 and iPadOS 27. No public exploit identified at time of analysis and EPSS is 0.17% (7th percentile), but the CVSS score of 5.5 reflects the high confidentiality impact; exploitation requires local app execution and user interaction, with no remote path.
RemediationAI
Vendor-released patch: iOS 27 and iPadOS 27. Upgrade affected devices via Settings > General > Software Update. There are no known workarounds that fully mitigate the issue; as a compensating control, users should avoid installing apps from untrusted sources, though this does not eliminate the risk from already-installed malicious apps. For detailed instructions, see the Apple advisory at https://support.apple.com/en-us/149034. After updating, no further action is required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an information disclosure flaw (CWE-200) in Apple iOS and iPadOS, rooted in insufficient permission restrictions. According to the CPE string cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*, all versions from 0 up to but not including 27 are affected. The attack vector is local (AV:L) and requires user interaction (UI:R), meaning an attacker must deliver a malicious app that the user installs and opens. No privileges are required (PR:N), but the app runs within Apple's sandbox and App Store review provides some mitigation. The flaw allows an app to bypass intended access controls and read sensitive user data, but it does not affect integrity or availability (I:N/A:N). The fix in iOS 27 and iPadOS 27 adds additional restrictions to close the permission gap.
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local malicious app is the vector (AV:L) needing user interaction (UI:R) but no elevated privileges (PR:N); permissions bypass discloses data (C:H) with no integrity or availability impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB