EUVD-2026-49607
GHSA-qmfh-v5vm-w2qv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSocial engineer user into installing malicious app
-
DeliveryLocal app execution on device
-
ExploitExploit improper contacts access checks
-
ExecutionRead contacts database
-
ImpactExfiltrate contact information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have the ability to deliver and run a malicious app on the victim's device. The user must install and open the app (user interaction required). No special device configuration is needed. Exploitation is limited to local, unauthenticated app execution, meaning the app has no network-based attack vector and requires user cooperation. |
| Impact | The CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates medium severity with a high confidentiality impact but limited by the need for local access and user interaction. EPSS places the exploitation probability at 0.15% (5th percentile), which is low. There is no KEV listing and no mention of public exploit code. The SSVC decision suggests a low priority for most organizations because the attack is not automatable (requires user interaction) and the technical impact is restricted to information disclosure. These signals consistently point to a low real-world risk, despite the moderate CVSS score. |
| Exploit ScenarioDerived | An attacker crafts a malicious app and tricks a user into installing it (e.g., via social engineering). Once installed and run locally, the app exploits the improper access checks and silently reads the user's contact list. No special privileges are needed; the attack succeeds if the user clicks to run the app. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Information disclosure in Apple iOS, iPadOS, and macOS Tahoe allows a malicious app with local access to read a user's contacts database. The flaw is fixed in iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6. No public exploit or active exploitation has been reported, and the EPSS score (0.15%) indicates low exploitation likelihood.
RemediationAI
Update to the patched versions: iOS 26.6, iPadOS 26.6, or macOS Tahoe 26.6. No workarounds are available; the primary mitigation is to install the vendor-released updates. Adhere to best practices by only installing trusted apps from the official App Store. Advisory links: https://support.apple.com/en-us/128066 (iOS/iPadOS) and https://support.apple.com/en-us/128067 (macOS).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the contacts database access controls on Apple operating systems (iOS, iPadOS, macOS Tahoe). Classified as CWE-200 (Exposure of Sensitive Information), the root cause is improper validation of app-level access to the user's address book. Affected versions include iOS and iPadOS versions prior to 26.6 and macOS Tahoe versions prior to 26.6, as indicated by the CPE strings cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos. The attack surface is local, requiring an app to execute on the device.
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Requires local app execution and user interaction, so AV:L and UI:R; no privileges needed, so PR:N.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
This issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6. An app may be able to access information about a user's contacts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB