EUVD-2026-78111
GHSA-6j8h-7g84-qjq8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitation requires a locally running app, so AV:L; no elevation needed (PR:N); the leaked persistent identifier is a high confidentiality impact only.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier.
AnalysisAI
Improper state management in Apple's operating systems (iOS/iPadOS, tvOS, visionOS, watchOS) allows a locally installed app to read a persistent account identifier that should have remained isolated, resulting in information disclosure. Affected platforms are all versions prior to the 27 release train on each OS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a locally installed and executed application on the target device (iOS/iPadOS, tvOS, visionOS, or watchOS) that can invoke the affected identifier API before the state-management fix is applied; this is a sandbox/state-management isolation failure, not a remote or network-reachable flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict and should be read carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the fixed release train: iOS 27 and iPadOS 27, tvOS 27, visionOS 27, and watchOS 27 (Apple advisories https://support.apple.com/en-us/149034, https://support.apple.com/en-us/149036, https://support.apple.com/en-us/149037, https://support.apple.com/en-us/149038). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
An issue was discovered in certain Apple products. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attacke
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today