EUVD-2026-49514
GHSA-6cg3-f6xf-3qv2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain physical access to locked device
-
ExploitConnect via USB or trigger interface
-
ExecutionExploit out-of-bounds read
-
ImpactRead sensitive information from kernel or system memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Physical access to the locked device is required. The vulnerability is triggered without authentication (PR:N) or user interaction (UI:N) while the device is in a locked state. Limiting factors: the attacker must have physical proximity and access to the device; the attack is not remotely exploitable and does not require special configurations or non-default settings. |
| Impact | The CVSS 3.1 base score of 4.6 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates medium severity with high confidentiality impact but requires physical access. EPSS score is 0.16% (percentile 6%), suggesting very low exploitation probability. No KEV listing or public PoC exists, reinforcing low real-world risk. The attack vector (physical) significantly limits exploitation compared to network-accessible flaws. There is no conflict among signals - all point to a locally-exploitable, low-priority issue. |
| Exploit ScenarioDerived | An attacker with physical access to a locked iPhone, iPad, or Mac could connect the device via USB or trigger the vulnerable interface to cause an out-of-bounds read, potentially revealing sensitive information such as notifications, credentials, or personal data. No public exploit code is known to exist. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Physical access to a locked Apple device running vulnerable iOS or macOS allows an attacker to view sensitive user information due to an out-of-bounds read. The flaw is fixed in iOS 26.6, iPadOS 26.6, and multiple macOS versions. No public exploit or active exploitation has been reported.
RemediationAI
Update to iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6 as provided by Apple via Software Update. No workarounds are available; mitigating physical access (e.g., strong passcodes, enabling Find My, avoiding unattended devices) reduces exposure but does not patch the vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an out-of-bounds read (CWE-125) in Apple's operating systems - iOS, iPadOS, and macOS - where improper bounds checking allows a physically present attacker to read beyond allocated memory buffers. Affected products per CPE include all versions of iOS and iPadOS before 26.6 and macOS before 15.7.8 (Sequoia), 14.8.8 (Sonoma), and 26.6 (Tahoe). This class of memory corruption typically occurs when handling specially crafted input during locked-device interactions.
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Physical access required (AV:P), low complexity, no privileges, no user interaction, high confidentiality impact only.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB