EUVD-2026-77919
GHSA-mwxp-5wgp-c85r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPublish/install malicious app on device
-
ExploitApp runs within normal sandbox
-
ExecutionInvoke affected API to read device name
-
ImpactCorrelate device name for fingerprinting/deanonymization
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a malicious or compromised app already installed and running locally on the affected Apple device (iOS/iPadOS 27, tvOS 27, visionOS 27, or watchOS 27 and earlier); the app needs only normal low-privilege sandbox execution (PR:L) and no user interaction beyond having been installed. Exploitation is limited to reading the device name - a single low-sensitivity identifier - and does not grant access to other user data, code execution, or privilege escalation. macOS is not affected. The practical gate is getting the app onto the device (App Store review, sideloading, or MDM/enterprise distribution), which bounds real-world exposure. |
| Impact | This is a genuinely low-priority issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 3.3 LOW) describes a local, already-installed malicious app with low privileges reading the device name - a confidentiality-only impact with no integrity or availability loss. EPSS is 0.16% (6th percentile), consistent with the fact that a device-name read is not remotely automatable and offers no direct code-execution payoff. There is no CISA KEV listing and no public exploit code, so exploitation status is 'no public exploit identified at time of analysis.' The one labeling tension worth noting: the tag 'Privilege Escalation' and CWE-269 (Improper Privilege Management) overstate the real impact - the description and the C:L/I:N/A:N vector describe pure information disclosure (fingerprinting), not any gain of privilege; CWE-200/CWE-359 would fit better. Bottom line: low real-world urgency, remediate via routine Apple OS patching rather than emergency response. |
| Exploit ScenarioDerived | A user installs a seemingly benign third-party app from the App Store or via sideloading/enterprise distribution; the app, running with normal sandbox privileges, invokes the affected API to read the device name (often set to the owner's real name, e.g. 'Jane's iPhone'). It then exfiltrates or combines this with other identifiers to fingerprint/deanonymize the user or device. No public exploit code exists and no user interaction beyond installing the app is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Apps installed on Apple iOS/iPadOS, tvOS, visionOS, and watchOS prior to version 27 can read the user-assigned device name without the additional authorization Apple intended, an improper permission-management flaw tracked as CVE-2026-86893 and fixed in the iOS 27, iPadOS 27, tvOS 27, visionOS 27 and watchOS 27 releases. The issue requires a malicious or compromised app already running locally with ordinary low-privilege sandbox access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 3.3) and yields nothing beyond disclosure of that single low-sensitivity identifier - no code execution, no privilege escalation, and no effect on integrity or availability, with macOS unaffected. There is no public exploit identified at time of analysis, EPSS is 0.16% (6th percentile), and the CVE is not in CISA KEV; the practical gate is getting a hostile app onto the device in the first place, which keeps real-world exposure low.
RemediationAI
Vendor-released patch: upgrade to iOS 27 and iPadOS 27, tvOS 27, visionOS 27 and watchOS 27, which is where Apple's additional permission restrictions on device-name access take effect; see the platform advisories at https://support.apple.com/en-us/149034, https://support.apple.com/en-us/149036, https://support.apple.com/en-us/149037 and https://support.apple.com/en-us/149038. Because exploitation depends entirely on a malicious or compromised app being installed and run locally, the effective compensating control on unpatched devices is app-distribution control: enforce MDM app allowlisting and block or disable sideloading and untrusted enterprise/developer distributions on managed iOS, iPadOS, tvOS, visionOS and watchOS fleets, at the cost of reduced user flexibility and additional administrative overhead in approving apps; there is no configuration switch that closes the permission gap itself. Where a device cannot be updated promptly, restrict installation to vetted App Store content and reinforce user guidance against installing unknown apps, while noting that these measures reduce but do not eliminate the risk from an already-trusted app that later turns malicious. Given the low sensitivity of the disclosed identifier, no additional containment of user data or network segmentation is warranted for this CVE alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-269 (Improper Privilege Management): an app-facing platform permission check for a device identifier was not restrictive enough, allowing an application to obtain the device name despite the sandbox restrictions intended to protect it. Apple's fix applies 'additional restrictions' to that permission path rather than correcting memory-safety or code-execution logic, which is consistent with the assessed vector (AV:L local, PR:L low privileges, UI:N none, C:L confidentiality-only, S:U scope unchanged). The identifier at issue is the device name a user assigns in Settings (for example, a personal name combined with a device model), making it a fingerprinting and potential user-name-inference primitive rather than a route to secrets, credentials, or other sandboxed data. CPE data maps the affected code base across four Apple platform families - cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:tvos, cpe:2.3:a:apple:visionos and cpe:2.3:a:apple:watchos - reflecting that these platforms share the affected framework, while macOS is explicitly outside the advisory scope. Four vendor advisories (support.apple.com/en-us/149034, 149036, 149037 and 149038) correspond to the respective platform updates.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Locally installed low-privilege app (AV:L/PR:L) reads only the device name with no interaction, yielding limited confidentiality impact (C:L) and no integrity or availability effect.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to read device name.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB