A logic issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. An app may be able to access sensitive user data.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Apple
  • Ios And Ipados
  • Ipados
  • Iphone Os
  • Macos
  • Tvos
  • Visionos

Configuration 1 [-]

OR cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://support.apple.com/en-us/149034 cve-icon cve-icon
https://support.apple.com/en-us/149035 cve-icon cve-icon
https://support.apple.com/en-us/149036 cve-icon cve-icon
https://support.apple.com/en-us/149038 cve-icon cve-icon
https://support.apple.com/en-us/149041 cve-icon cve-icon
https://support.apple.com/en-us/149042 cve-icon cve-icon
https://support.apple.com/en-us/149043 cve-icon cve-icon
History

Mon, 21 Sep 2026 00:00:00 +0000

Type Values Removed Values Added
Title Logic Validation Issue Allowing Sensitive Data Access in Apple OSes

Sun, 20 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Title Logic flaw potentially exposing sensitive user data on Apple devices
Weaknesses CWE-20

Wed, 16 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Wed, 16 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-693
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Title Logic flaw potentially exposing sensitive user data on Apple devices
Weaknesses CWE-20

Tue, 15 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple tvos
Apple visionos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple tvos
Apple visionos

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description A logic issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. An app may be able to access sensitive user data.
References
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published: 2026-09-14T20:47:43.216Z

Updated: 2026-09-16T12:44:50.430Z

Reserved: 2026-07-22T00:47:18.620Z

Link: CVE-2026-65406

cve-icon Vulnrichment

Updated: 2026-09-16T12:44:26.466Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-14T21:17:24.197

Modified: 2026-09-16T18:26:37.867

Link: CVE-2026-65406

cve-icon Redhat

No data.