EUVD-2026-78049
GHSA-jp42-wwp7-m94w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
ExploitApp invokes affected privacy-gated interface
-
ExecutionBypass Privacy preference check
-
ImpactRead sensitive user data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a malicious or overprivileged app to already be installed and running locally on an affected Apple device (iOS/iPadOS before 26.7 or before 27, or visionOS before 27); the app then bypasses a specific Privacy preference control to access sensitive data it was not authorized for. Limiting factors: exploitation is local-only (AV:L) and needs code execution on the device (a sandboxed app, PR:L), so it cannot be triggered remotely or by an unauthenticated network attacker; no user interaction is required beyond having installed the app. The exact privacy control affected is not specified by Apple, limiting precise detection. |
| Impact | This is a genuinely low-priority issue, and the multiple signals agree rather than conflict. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 3.3) describes a locally-exploitable, low-privilege confidentiality-only flaw: an already-installed app on the device bypasses a privacy preference to read some sensitive data it should not have access to. EPSS is very low (0.17%, 7th percentile), there is no CISA KEV listing and no public exploit identified, so this is neither actively exploited nor trivially weaponizable remotely. The impact is limited to a low confidentiality leak with no integrity or availability effect and no scope change. There is no signal conflict here - every source (Apple's own advisory, the low CVSS, low EPSS, absence of KEV/POC) points the same direction. The only caveat is that Apple's advisories are characteristically terse ('bypass certain Privacy preferences'), so the exact data exposed is not precisely disclosed; defenders should treat 'C:L' as vendor-assigned rather than independently verified. |
| Exploit ScenarioDerived | A malicious or overprivileged app that a user has already installed on an iPhone, iPad, or Vision Pro leverages the flaw to read data protected by a Privacy preference (e.g., a permission the user never granted it). No public exploit code is available and no remote or network access is involved; exploitation is purely local to the device via the installed app. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Local apps on iOS, iPadOS, and visionOS can bypass certain Privacy preference controls and reach sensitive data they were never authorized to see; Apple addressed it by removing sensitive data from the reachable location. Affected are iOS and iPadOS before 26.7 and before 27, plus visionOS before 27, with fixes shipped in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, and visionOS 27. Exploitation is local-only and requires a malicious or overprivileged app to already be installed and running on the device (CVSS 3.3, AV:L/PR:L/UI:N, low confidentiality impact); there is no public exploit identified at time of analysis and EPSS is negligible at 0.17% (7th percentile).
RemediationAI
Apply the vendor-released patch: upgrade to iOS 26.7 or iPadOS 26.7 (or the iOS 27 / iPadOS 27 releases for devices tracking the newer branch) and to visionOS 27, as documented in Apple's advisories at https://support.apple.com/en-us/149034, https://support.apple.com/en-us/149038, and https://support.apple.com/en-us/149041. Because exploitation requires an already installed app running locally, the most effective compensating control where immediate patching is not possible is to reduce the local app attack surface: enforce an allow-listed, MDM-managed app catalog and disable user- or enterprise-sideloaded applications, accepting the trade-off that this blocks legitimate internal distribution and developer testing workflows; alternatively, revoke or refrain from granting privacy-sensitive permissions (for example contacts, photos, or location) to untrusted apps, understanding that this issue specifically concerns bypassing such preferences and therefore offers only partial protection; also review installed apps and profiles for anything untrusted and consider removing it. Note that detection is difficult because Apple does not disclose the specific privacy preference being bypassed, so monitoring should focus on anomalous data access by normally benign apps rather than on a known indicator. Given the low CVSS score (3.3) and very low EPSS (0.17%), patching can be scheduled through normal maintenance windows rather than treated as an emergency, but it should not be skipped on devices that routinely install third-party or enterprise-sideloaded apps.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apple's privacy-preference layer governs what sandboxed applications may read on iOS, iPadOS, and visionOS, and this issue is a failure of that control boundary rather than a memory-safety or remote-code-execution class bug; no CWE identifier was assigned by the source data, so the root cause is best characterized as improper access control / information disclosure through retained sensitive data. According to Apple, the fix was implemented by removing sensitive data, indicating that information which should have been inaccessible to apps remained in a location reachable by a local process, allowing an installed app to circumvent the intended privacy preference. CPE data identifies two affected product families: cpe:2.3:a:apple:ios_and_ipados (all versions within the affected ranges) and cpe:2.3:a:apple:visionos. The exact privacy control involved is not specified in the Apple advisory, which limits precise detection and fingerprinting of attempted abuse; the practical security value of the bug is bounded by the fact that it grants only low-integrity read access (C:L) from inside the sandbox, with no impact on integrity or availability.
Know when Visionos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploited by a locally-installed sandboxed app (AV:L, PR:L), no user interaction, yielding only a limited confidentiality leak of privacy-protected data (C:L, I/A:N).
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to bypass certain Privacy preferences.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerabi
A denial of service vulnerability in This (CVSS 4.2). Risk factors: actively exploited (KEV-listed).
A logic issue was addressed with improved state management. Rated critical severity (CVSS 9.8), this vulnerability is re
An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab
Exploit-DB