EUVD-2026-77862
GHSA-q96h-8j24-wxc8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDistribute malicious app to device
-
ExploitUser installs low-privilege app
-
ExecutionTrigger improper authorization flaw
-
ImpactRead sensitive user data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a malicious or compromised application already installed and running locally on an affected Apple device (iOS/iPadOS < 26.7 or < 27, tvOS < 27, visionOS < 27); there is no remote or network attack surface. The app needs only ordinary low-level sandbox privileges (PR:L) and no user interaction (UI:N). Exploitation is LIMITED by the need to first get a malicious app onto the device (App Store review, sideloading, or MDM/enterprise distribution) and by the read-only, confidentiality-only impact - the flaw grants no code execution, no integrity modification, and no availability effect. macOS is not affected. |
| Impact | This is a low-priority, genuinely-low-real-risk issue despite its Medium 5.5 CVSS. The CVSS vector is internally consistent and correctly reflects a locally-scoped flaw: AV:L (a malicious app must already run on the device), AC:L, PR:L (low-privilege sandboxed app), UI:N, S:U, and confidentiality-only impact (C:H/I:N/A:N). EPSS is 0.16% (6th percentile), signaling near-zero predicted exploitation. There is NO CISA KEV listing and NO public POC, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision framework data was provided. All signals agree in the same direction - low probability, high pre-conditions, bounded (read-only) impact - so this is a legitimate but non-urgent patch-in-normal-cycle item, not an emergency. One data-quality conflict to note: the input Tags label this 'Authentication Bypass,' which contradicts both the CWE-285 (Improper Authorization) classification and the description (an authorization/access-control failure yielding data read, not any authentication bypass). Treat the tag, not the CVSS, as the erroneous signal. |
| Exploit ScenarioDerived | A user installs a seemingly benign app from the App Store or via sideloading/enterprise distribution. Because of an improper authorization state-management flaw, that app - running with only ordinary sandbox privileges - is able to read sensitive user data it should not be entitled to access, without any user prompt or interaction. No public exploit code is known, so an attacker would need to develop and distribute the malicious app themselves. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
An app on an affected Apple device can bypass authorization checks and read sensitive user data it should not be able to reach, due to improper state management in iOS and iPadOS before 26.7 and before 27, tvOS before 27, and visionOS before 27. The attacker must already have a malicious or compromised app installed and running locally on the device with ordinary low-level sandbox privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so there is no remote or network attack surface and no user interaction is needed once that app is present; the impact is confidentiality-only (C:H) with no code execution, integrity, or availability effect, and macOS is unaffected. There is no public exploit identified at time of analysis, EPSS is negligible at 0.16% (6th percentile), and Apple has released fixed versions (iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, tvOS 27, visionOS 27) - Apple self-reports the issue, though the CVE record carries no vendor attribution in the reference metadata.
RemediationAI
Apply the vendor-released patches: iOS 26.7 or iOS 27 (and the matching iPadOS 26.7/27), tvOS 27, and visionOS 27 - updates are delivered through standard Apple software-update channels and, for managed fleets, can be enforced via MDM software-update policies and deferral profiles. Apple's per-platform advisories provide the authoritative details and affected-version confirmations: https://support.apple.com/en-us/149034, https://support.apple.com/en-us/149036, https://support.apple.com/en-us/149038, and https://support.apple.com/en-us/149041. Because exploitation requires a malicious or compromised app already installed on the device with only low sandbox privileges (no user interaction), the practical interim mitigation is App Store review; if sideloading is enabled, disable sideloading or restrict it to trusted developer profiles, and use MDM allow-listing to limit installable apps to approved App Store titles - noting that these controls trade flexibility for reduced app availability and can be bypassed by enterprise/MDM-sideloaded or user-installed profiles on unmanaged devices, so they are compensating measures rather than fixes. Organizations should also weigh the negligible EPSS (0.16%, 6th percentile), the absence of public exploit code, and the read-only confidentiality-only impact when prioritizing the update; macOS-specific mitigations are unnecessary, and no specific port or feature disablement applies since the vector is local app-to-data access rather than network-reachable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified CWE-285 (Improper Authorization) and Apple describes the root cause as a failure of state management within an iOS/iPadOS/tvOS/visionOS subsystem - meaning a component tracked or transitioned authorization state incorrectly, allowing a sandboxed app to reach data belonging to another app or to the user after it should have been denied. The affected ecosystem is Apple's mobile and spatial platforms, reflected by the CPEs cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:tvos, and cpe:2.3:a:apple:visionos (all versions below the fixed releases), with macOS conspicuously absent from the affected set. The CVSS vector confirms the technical character of the issue: attack vector Local (AV:L), low complexity (AC:L), low privileges (PR:L, i.e. an ordinary app-level sandbox context rather than root or system entitlements), no user interaction (UI:N), and a solely confidentiality-oriented impact (C:H/I:N/A:N, scope unchanged). This is a sandbox/authorization-boundary weakness exploited from an app the victim has already installed, not a memory-safety or remote-input flaw, and the EUVD affected-version data (iOS/iPadOS 0 <26.7 and 0 <27, tvOS 0 <27, visionOS 0 <27) matches the patched versions in Apple's advisories.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local malicious app with low sandbox privileges (AV:L/PR:L), no user interaction, yielding read-only access to sensitive data (C:H, I:N/A:N); matches Apple's vector.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, tvOS 27, visionOS 27. An app may be able to access sensitive user data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB