EUVD-2026-77864
GHSA-44c6-x779-mqcc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker publishes malicious app
-
ExploitUser installs and runs app locally
-
ExecutionApp abuses permissions weakness
-
ImpactAccess sensitive user data (confidentiality loss)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a malicious or compromised app already installed and executing locally on an affected device (AV:L, PR:L, UI:N), running iOS/iPadOS, visionOS, or watchOS prior to version 27. There is no remote or network-based path and no unauthenticated vector. Exploitation is limited to reading sensitive user data (C:H only; no integrity or availability impact) and is fully mitigated by updating to iOS 27/iPadOS 27, visionOS 27, or watchOS 27. macOS and tvOS are not listed as affected. |
| Impact | This is a genuinely low-priority issue despite the 'medium' 5.5 base score. The vendor-provided CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires local access via an already-installed app holding some privilege (PR:L), with impact limited to confidentiality (C:H, I:N, A:N) - no code execution, no integrity or availability effect, no scope change. Corroborating signals all point down: EPSS is 0.16% (6th percentile), the CVE is NOT in CISA KEV, and no public exploit or POC is referenced (only Apple support advisories). The exploitation status is 'no public exploit identified at time of analysis.' The advisory is an Apple self-report ('improved with additional restrictions') with no exploitation claim. The one inflating factor is C:H, which Apple applies broadly to any 'sensitive user data' access; the real-world impact is a local information-disclosure/permissions bypass, not remote compromise. No conflicting signals of concern - the low EPSS and absence of KEV are consistent with a locally-gated, self-reported hardening fix. Prioritize via normal OS patch cadence, not emergency response. |
| Exploit ScenarioDerived | A user installs a malicious or over-permissioned app from a trusted source; once running locally on the device, the app abuses a permissions weakness to reach sensitive user data it should not be entitled to access. Because exploitation requires local execution of an app already on the device (AV:L, PR:L) and no user interaction beyond having the app present, impact is confined to reading protected data. No public exploit code is identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Insufficient permission restrictions in Apple's iOS/iPadOS, visionOS, and watchOS allow an app already installed and running locally on the device to reach sensitive user data it should not be able to read. Exploitation requires local code execution with the privileges of a normal installed app (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and yields confidentiality impact only - no integrity or availability effect, and no remote or unauthenticated path. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.16% (6th percentile), so this is a low-priority, patch-and-move-on issue that is fully resolved by updating to iOS 27/iPadOS 27, visionOS 27, or watchOS 27; macOS and tvOS are not listed as affected.
RemediationAI
Vendor-released patch: iOS 27, iPadOS 27, visionOS 27, and watchOS 27 - update each affected device to its respective version 27 release (see Apple advisories https://support.apple.com/en-us/149034, https://support.apple.com/en-us/149037, and https://support.apple.com/en-us/149038). No reboots of dependent systems are required, but note that iOS/iPadOS 27, visionOS 27, and watchOS 27 cannot be installed on hardware Apple no longer supports, so end-of-support devices will remain exposed. If immediate updating is not feasible, compensating controls are limited because the flaw is in the platform's own permission enforcement: restrict installation to trusted sources and use MDM allow-listing or managed device policies to prevent untrusted sideloaded or enterprise-signed apps from running (trade-off: reduces user flexibility and requires MDM enrollment), keep sensitive data out of apps that cannot be vetted, and remove or untrust unknown profiles and apps on high-value devices. These measures reduce exposure only; they do not fix the underlying permissions flaw. Given EPSS of 0.16% (6th percentile), no KEV listing, and no public exploit identified at time of analysis, remediation can follow a normal patch cycle rather than emergency change control; prioritize devices holding regulated or high-sensitivity user data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-269 (Improper Privilege Management): the affected operating systems failed to apply adequate restrictions on what an application may access, so a sandboxed app could cross a permission boundary and read sensitive user data. Apple's fix, described as 'additional restrictions,' is a hardening of the platform's app-permission enforcement layer (the mechanism analogous to the sandbox and privacy/TCC-style consent framework) rather than a memory-safety correction. CPE data maps the impacted platforms as cpe:2.3:a:apple:ios_and_ipados (before 27), cpe:2.3:a:apple:visionos (before 27), and cpe:2.3:a:apple:watchos (before 27), with EUVD listing the ranges as 'iOS and iPadOS 0 <27', 'visionOS 0 <27', and 'watchOS 0 <27'. The CVSS vector's AV:L/PR:L reflects that the attacker must already have a malicious or compromised app installed and executing on the device; UI:N indicates no additional user interaction is needed once that app runs; and the C:H/I:N/A:N scope-unchanged profile confirms the impact is confined to disclosure of sensitive user data.
Know when Visionos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Locally-installed app with some privilege (AV:L, PR:L, UI:N) abuses a permissions flaw to read sensitive data; confidentiality-only impact, no integrity/availability effect and no scope change.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerabi
A denial of service vulnerability in This (CVSS 4.2). Risk factors: actively exploited (KEV-listed).
A logic issue was addressed with improved state management. Rated critical severity (CVSS 9.8), this vulnerability is re
An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab
Exploit-DB