Description
A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An app may be able to fingerprint the user.
Published: 2025-11-04
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: User privacy compromise via fingerprinting
Action: Apply patch
AI Analysis

Impact

A privacy flaw allows an application to read sensitive data that had been incorrectly moved, enabling the app to fingerprint the user. The weakness is an insecure permission configuration (CWE‑276), which means user data is accessible to software that should not have that level of access. If exploited, the attacker can uniquely identify or track the user across sessions or services, resulting in privacy violations.

Affected Systems

Apple devices running iOS, iPadOS, macOS, visionOS, or watchOS with versions prior to the fixed releases (iOS 18.7.2 or 26.1, iPadOS 18.7.2 or 26.1, macOS Tahoe 26.1, visionOS 26.1, and watchOS 26.1) are affected. These systems are vulnerable until patched to one of the specified fixed releases.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is an installed application that requests broader permissions than needed; from that context, the app can read the exposed sensitive data and derive a fingerprint.

Generated by OpenCVE AI on April 27, 2026 at 23:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest OS release where the issue is fixed (iOS 18.7.2 or later, iPadOS 18.7.2 or later, macOS Tahoe 26.1 or later, visionOS 26.1 or later, or watchOS 26.1 or later).
  • Verify that installed apps have the minimal permissions required and remove any unnecessary permissions that could allow access to sensitive data.
  • Monitor device logs for unexpected access to sensitive information and audit third‑party apps regularly.

Generated by OpenCVE AI on April 27, 2026 at 23:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Title Improperly Exposed Sensitive Data Enables App Fingerprinting

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description A privacy issue was addressed by moving sensitive data. This issue is fixed in watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. An app may be able to fingerprint the user. A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An app may be able to fingerprint the user.

Wed, 17 Dec 2025 21:00:00 +0000

Type Values Removed Values Added
Description A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. An app may be able to fingerprint the user. A privacy issue was addressed by moving sensitive data. This issue is fixed in watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. An app may be able to fingerprint the user.
References

Wed, 05 Nov 2025 19:30:00 +0000

Type Values Removed Values Added
References

Wed, 05 Nov 2025 18:45:00 +0000

Type Values Removed Values Added
Description A privacy issue was addressed by moving sensitive data. This issue is fixed in watchOS 26.1, iOS 26.1 and iPadOS 26.1, visionOS 26.1. An app may be able to fingerprint the user. A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. An app may be able to fingerprint the user.
References

Tue, 04 Nov 2025 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple iphone Os

Tue, 04 Nov 2025 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-276
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 04 Nov 2025 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios
Apple ipados
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios
Apple ipados
Apple visionos
Apple watchos

Tue, 04 Nov 2025 01:45:00 +0000

Type Values Removed Values Added
Description A privacy issue was addressed by moving sensitive data. This issue is fixed in watchOS 26.1, iOS 26.1 and iPadOS 26.1, visionOS 26.1. An app may be able to fingerprint the user.
References

Subscriptions

Apple Ios Ipados Iphone Os Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:13:26.673Z

Reserved: 2025-04-16T15:27:21.194Z

Link: CVE-2025-43507

cve-icon Vulnrichment

Updated: 2025-11-04T16:23:14.833Z

cve-icon NVD

Status : Modified

Published: 2025-11-04T02:15:53.560

Modified: 2026-04-02T19:20:56.737

Link: CVE-2025-43507

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-27T23:30:15Z

Weaknesses