EUVD-2026-25052
GHSA-3hwj-7r29-g5vv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain physical or paired logical access to device
-
ExploitAccess on-device log or notification storage
-
ExecutionRead notification payloads marked as deleted
-
ImpactExtract sensitive personal information from retained entries
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection PII protection
|
| Exploitation Conditions | Local access to the iOS or iPadOS device is required (CVSS AV:L), meaning the attacker must have physical possession of the device or direct logical access to its file system (e.g., via a connected computer with a trusted pairing record, an MDM enrollment, or a forensic extraction tool). Per CVSS PR:N, no user-level or system-level authentication credentials on the device itself are needed once local file system access is established - the retained notification logs are accessible at that point. SSVC confirms the attack is not automatable, ruling out network-scale exploitation. Exploitation is limited to devices running iOS/iPadOS below 18.7.8 or below 26.4.2 where the deletion-triggered redaction was not functioning. Remote attackers without physical or paired local access cannot exploit this vulnerability. |
| Impact | The CVSS 3.1 base score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a local-only attack surface with no complexity barrier and no privileges required, but the scope is limited to a single device (S:U) with confidentiality-only impact. The C:H designation is warranted because notification content can include sensitive personal communications (messages, emails, banking alerts), but integrity and availability are unaffected (I:N/A:N). EPSS at 0.02% (5th percentile) signals minimal automated exploitation interest. SSVC corroborates: exploitation status is none, the attack is not automatable, and technical impact is only partial. There is no CISA KEV listing and no public POC identified at time of analysis. Cross-referencing these signals, this is a genuine privacy concern on affected devices - particularly meaningful in physical-access threat models (lost/stolen devices, device forensics, shared devices) - but it does not represent an urgent mass-exploitation risk. The local vector materially constrains real-world attack scenarios. |
| Exploit ScenarioDerived | An attacker with physical access to a lost or stolen iOS device - or with logical access via a connected forensic tool or iTunes/Finder backup - inspects on-device log files or notification storage and recovers the content of notifications the user had already deleted, including message previews, authentication codes, or alert text from banking or messaging applications. No public exploit code exists at time of analysis, and the local-only vector prevents remote exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Notification data retention in Apple iOS and iPadOS exposes deleted notification content to local access due to insufficient log redaction. Devices running iOS/iPadOS prior to 18.7.8 or 26.4.2 retain notification payloads after user deletion, constituting a CWE-359 private information exposure. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.02% (5th percentile), and SSVC assessment classifies exploitation as none - indicating low real-world threat velocity despite a CVSS confidentiality impact of High.
RemediationAI
Update to iOS 18.7.8 or iPadOS 18.7.8 (legacy branch) or iOS 26.4.2 or iPadOS 26.4.2 (current branch) via Settings > General > Software Update. Vendor patch is confirmed available per Apple security advisories at https://support.apple.com/en-us/127002 and https://support.apple.com/en-us/127003. For environments where immediate patching is not feasible - such as managed MDM fleets pending validation - a compensating control is to enable full-device encryption via passcode enforcement (already default on modern iOS) to ensure log storage is protected at rest, reducing the risk from physical-access scenarios. Organizations handling sensitive notifications (healthcare, finance, legal) should treat this as a priority update given the C:H confidentiality impact on notification content. No workarounds are documented by Apple that substitute for the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the notification subsystem of Apple iOS and iPadOS, where log entries or on-device storage buffers failed to properly redact notification content when the notification was marked for deletion. CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor) identifies the root cause: sensitive data - in this case notification payloads that users or the OS intended to discard - was not purged from logging infrastructure, leaving it accessible locally. The fix involved improved data redaction logic in the logging layer. Affected products per CPE: cpe:2.3:a:apple:ios_and_ipados covering all versions below 18.7.8 (legacy branch) and below 26.4.2 (current branch). The attack vector is strictly local (AV:L), meaning exploitation requires physical or logical access to the device's storage.
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Local vector required for file system access; no auth needed once device is physically accessible; confidentiality-only impact as notification content is read but not modified.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.8 and iPadOS 18.7.8, iOS 26.4.2 and iPadOS 26.4.2. Notifications marked for deletion could be unexpectedly retained on the device.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB