Description
The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. A malicious app may be able to access protected user data.
Published: 2026-07-27
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability stems from insufficient input sanitization that allows a malicious application to read protected user data. The failure results in a confidentiality breach, as attackers can extract sensitive information without requiring elevated privileges.

Affected Systems

Apple iOS, iPadOS, macOS (Sequoia, Sonoma, Tahoe), visionOS, and watchOS are affected in all releases prior to the fixes published in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, and watchOS 26.6.

Risk and Exploitability

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or semi‑local through the installation of a malicious application that can trigger the insufficient sanitization. No remote code execution or privilege escalation is indicated; the damage is limited to data leakage within the context of the compromised app.

Generated by OpenCVE AI on August 4, 2026 at 13:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update all Apple devices to the latest public release version that contains the fix (iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6).
  • Enable automatic system updates so that future patches are applied without manual intervention.
  • Restrict app installations to the Apple App Store and ensure developers are vetted; avoid sideloading or installing untrusted applications.

Generated by OpenCVE AI on August 4, 2026 at 13:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Title Insufficient Input Sanitization Allowing Malicious App to Access Protected User Data

Mon, 03 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
Title Improper Input Sanitization Enables Malicious App to Access Protected User Data
Weaknesses CWE-200

Thu, 30 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
Title Improper Input Sanitization Enables Malicious App to Access Protected User Data
Weaknesses CWE-200

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 28 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple visionos
Apple watchos

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. A malicious app may be able to access protected user data.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-07-28T14:46:19.018Z

Reserved: 2026-05-01T22:46:21.644Z

Link: CVE-2026-43714

cve-icon Vulnrichment

Updated: 2026-07-28T14:46:08.904Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-27T21:16:55.523

Modified: 2026-07-28T19:31:39.390

Link: CVE-2026-43714

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T13:45:03Z

Weaknesses
  • CWE-20

    Improper Input Validation