EUVD-2026-77989
GHSA-r3jc-8qw8-j9cx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall/run app on device
-
ExploitAbuse permissions gap to read identifiers
-
ExecutionBuild persistent user fingerprint
-
ImpactTrack or deanonymize user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a malicious or privacy-abusing app to already be installed and executing on the target device (iOS/iPadOS/macOS/visionOS/watchOS before version 27); the vendor's AV:N is inconsistent with this local app-execution requirement. No remote network vector, no separate authentication, and no user interaction beyond running the app are needed, but the attacker must first get their app onto the device. Impact is limited to privacy fingerprinting/tracking of the user - no data theft, code execution, or system compromise. Patched builds add sandbox restrictions that close the identifier-access path. |
| Impact | The vendor CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) is drastically inflated and internally inconsistent with the description, which states only that 'an app may be able to fingerprint the user' - a local, information-disclosure-only issue addressed via additional sandbox restrictions (CWE-200). AV:N is almost certainly wrong: the threat actor is a locally-installed/running app on the device, not a remote network attacker, so this should be AV:L. C:H/I:H are also unjustified - user fingerprinting exposes a limited set of device/user identifiers (C:L at most) and causes no integrity impact (I:N). Corroborating signals confirm the low real-world risk: EPSS is only 0.16% (6th percentile), there is no CISA KEV listing (not actively exploited), and no public exploit code was identified. My independent assessment lands near CVSS 3.3, not 9.1. This is a low-priority privacy hardening fix, not an emergency - the high vendor score reflects Apple's conservative boilerplate scoring rather than genuine severe risk. |
| Exploit ScenarioDerived | A malicious or privacy-invasive app distributed through side-loading or a store, once running on the device, abuses a permissions/sandbox gap to read stable device or user identifiers that enable persistent cross-app or cross-session fingerprinting of the user without consent. No public exploit code was identified, and exploitation yields tracking/deanonymization rather than data theft or code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Information disclosure in Apple iOS, iPadOS, macOS, visionOS, and watchOS before version 27 allows a malicious or privacy-abusing app already installed on the device to fingerprint the user by accessing identifiers that should be restricted by the sandbox. The vendor's CVSS 9.1 is drastically inflated and inconsistent with the description; our assessment is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, with impact limited to privacy tracking rather than data theft, code execution, or system compromise. Apple fixed the issue in iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27 by adding sandbox restrictions; no public exploit identified at time of analysis and EPSS is low at 0.16% (6th percentile).
RemediationAI
Apply the vendor-released patches by updating to iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, or watchOS 27; these builds add sandbox restrictions that close the fingerprinting path. Vendor advisories with update details are available at https://support.apple.com/en-us/149034, https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149037, and https://support.apple.com/en-us/149038. No public exploit code has been identified and EPSS is 0.16% (6th percentile), so mass exploitation is unlikely, but privacy-sensitive environments should prioritize updates. If immediate updating is not possible, enforce managed app installation policies, restrict apps to trusted sources, and review installed apps for unexpected identifier access; these controls reduce exposure but do not fully eliminate the sandbox weakness and may limit legitimate app functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a permissions/sandbox weakness in Apple's operating system frameworks (CWE-200, Exposure of Sensitive Information to an Unauthorized Actor) that let an app bypass intended isolation boundaries and gather device/user fingerprinting data. CPE data covers cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*, cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, cpe:2.3:a:apple:visionos:*:*:*:*:*:*:*:*, and cpe:2.3:a:apple:watchos:*:*:*:*:*:*:*:*, corresponding to iOS and iPadOS before 27, macOS before Golden Gate 27, visionOS before 27, and watchOS before 27. The assessed attack vector is local (AV:L) and requires low privileges (PR:L), meaning the attacker must already have a malicious or privacy-abusing app installed and executing; once running, the app can read identifiers that should have been restricted. The vendor's NVD vector (AV:N/AC:L/PR:N/UI:N) is inconsistent with this local app-execution prerequisite. Patched builds add sandbox restrictions that close the identifier-access path, consistent with Apple's description of the fix.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Locally-installed app is the attacker (AV:L, PR:L); fingerprinting leaks limited identifiers (C:L) with no integrity or availability impact (I:N/A:N).
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. An app may be able to fingerprint the user.
Executive ViewAI
Apple iOS, iPadOS, macOS, visionOS, and watchOS devices running versions before 27 are affected by a sandbox information-disclosure flaw that could allow an already-installed app to fingerprint users via restricted identifiers. Independent analysis indicates the practical business impact is limited to privacy tracking, with no public exploit identified at time of analysis and a vendor patch available. Leadership should prioritize fleet-wide patching because affected Apple devices may carry privacy and compliance exposure, though the risk of data theft or system compromise is low.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB