iOS EUVD-2026-15153

Remote unauthenticated exploitation. Affects iOS/iPadOS versions below 18.7.7 and 26.4, macOS Sequoia below 15.7.5, Sonoma below 14.8.5, Tahoe below 26.4, and visionOS below 26.4. An app with local file system access can exploit the path validation flaw to access sensitive user data.

Without published CVSS vector details or EPSS scores, risk assessment relies on available signals: Apple's coordinated release of patches across six separate security bulletins (references 126792-126796, 126799) indicates high organizational priority and acknowledgment of real exploitation risk. The information disclosure tag and multi-platform, multi-version scope suggest this affects the core OS rather than a specific application, amplifying exposure. The absence of a disclosed POC or KEV status does not diminish risk, as Apple typically withholds such details for critical path-based vulnerabilities. From an SSVC perspective, exploitation appears technically feasible given that unprivileged applications can trigger path parsing logic, the impact is straightforward (sensitive data disclosure), and patches are available. Organizations should treat this as a high-priority patch given the breadth of affected products and the fundamental nature of the vulnerability in OS-level path handling.

A malicious application could craft specially formatted file path requests that bypass Apple's path validation logic, allowing it to read sensitive files outside its sandbox boundaries such as user keychain data, contacts, medical records, or files from other applications' containers. The attacker would likely craft the exploit within an app submitted to the App Store or distributed through enterprise channels, then trigger the path traversal when a user grants minimal permissions (such as general app usage). Once the path validation flaw is exploited, the app gains access to sensitive user data without additional user interaction or explicit privilege escalation, making this a high-impact information disclosure vector applicable to both consumer and enterprise users.