EUVD-2026-77874
GHSA-7j3c-v3cm-m262
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick user into installing malicious app
-
ExploitApp runs with local privileges
-
ExecutionRead unredacted location data from system logs
-
ImpactExfiltrate user's current location
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Log data sanitization
|
| Exploitation Conditions | Requires a malicious application already installed and executing locally on the affected Apple device (PR:L, AV:L) - this is not remotely reachable and needs no user interaction (UI:N) once the app is running. Exploitation is limited by Apple's app-distribution controls (App Store review, sideloading/MDM restrictions) that gate getting the malicious app onto the device, and by the fact that the flaw only discloses the user's current location - no integrity or availability impact. Applies to iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe/Golden Gate before 26.7/27, and tvOS/visionOS/watchOS before 27. |
| Impact | This is a low-priority, confidentiality-only privacy leak despite its MEDIUM 5.5 rating. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the flaw is only reachable by an already-installed local application holding some privileges (PR:L) - it is NOT remotely exploitable and grants no integrity or availability impact. The C:H rating reflects that the leaked datum (the user's current geolocation) is genuinely sensitive, but the real-world attack surface is narrow: an attacker must first get a malicious app onto the device. Exploitation signals reinforce low urgency: EPSS is 0.21% (11th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis. There are no conflicting signals - CVSS local vector, low EPSS, and the Apple self-reported description all agree this is a defense-in-depth log-redaction hardening fix, not an actively exploited priority. Note the CVSS 5.5 C:H is arguably generous for a single leaked location value versus bulk data theft, but it is defensible. Patch is already available across all affected OSes. |
| Exploit ScenarioDerived | A user installs a seemingly benign third-party app from the App Store or via sideloading/enterprise provisioning. The app, without holding location permission itself, reads unredacted system log entries that contain the device's current location and exfiltrates it, defeating the user's location-privacy expectations. No public exploit code exists and no active exploitation is reported. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
A privacy flaw in Apple operating systems lets a malicious application already running on the device determine the user's current location, because location data was not properly redacted from log entries (CWE-532). The issue is local-only: the CVSS vector (AV:L, PR:L, UI:N, C:H/I:N/A:N) means an attacker must first get a malicious app installed and executing on the target device, after which no further user interaction is needed, and the impact is confined to confidentiality - the user's location is disclosed with no integrity or availability effect. Apple has fixed the flaw in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27; there is no public exploit identified at time of analysis, EPSS is very low (0.21%, 11th percentile), and the practical barrier is Apple's app-distribution controls rather than any remote attack path.
RemediationAI
Vendor-released patch: update to iOS 26.7 or iOS 27 (and the matching iPadOS releases), macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 - see the Apple advisories at support.apple.com/en-us/149034 through 149043 for the platform-specific builds. Because a patched version exists for every affected OS, upgrading is the only reliable fix and there is no partial mitigation that removes the log-redaction defect itself. Where immediate patching is not possible, compensating controls must be applied at the app layer rather than the OS: keep App Store review and sideloading/MDM restrictions in force so untrusted apps cannot reach the device in the first place, restrict which applications are permitted to run or to read system logs via MDM profiles, and disable location services for non-essential apps - noting the trade-off that turning off Location Services breaks mapping, fitness, and emergency features, and that log-access restrictions may interfere with legitimate diagnostics and enterprise telemetry. None of these workarounds address the underlying logging flaw, so they should be treated strictly as temporary measures until the OS updates above are installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-532, Insertion of Sensitive Information into Log File: Apple's logging subsystem was recording data that included the user's location without adequate redaction, so an app with local log-reading privileges could recover it. Apple's fix is described as improved private data redaction for log entries, i.e. a data-handling correction in the OS logging pipeline rather than a memory-safety or input-validation bug. The attack surface is strictly local (AV:L) and requires the attacker to already hold app-execution privileges on the device (PR:L); no user interaction is required once the malicious app is running (UI:N). Because only current location is exposed, the scoring vector confirms high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N), and the unchanged scope (S:U) indicates the leak stays within the app/OS privacy boundary. Affected CPE families cover the entire Apple platform line - ios_and_ipados, macos, tvos, visionos, and watchos - which is consistent with a shared logging component duplicated across Apple's OS forks.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local malicious app with low privileges (AV:L/PR:L) reads sensitive location data from logs; confidentiality-only (C:H) with no integrity or availability impact and no scope change.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A malicious application may be able to determine a user's current location.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB