CVE-2026-65339

Logic flaw enabling applications to leak sensitive user information on Apple platforms

Published Aug 17, 2026 CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Description

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to leak sensitive user information.

Analysis

Technical impact

A logic issue in Apple’s operating systems can allow an application to leak sensitive user information. The flaw was addressed by adding improved checks and has been fixed in iOS 18.7.11, iPadOS 18.7.11, iOS 26.6.1, iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27. Devices that have not installed these updates remain vulnerable.

Affected Systems

Affected systems include Apple iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8 and macOS Tahoe 26.6.2, as well as tvOS 27, visionOS 27, and watchOS 27. Devices running earlier versions before these releases are vulnerable. All relevant Apple platforms are enumerated in the CNA vendor‑product list.

Risk and Exploitability

The CVSS base score of 5 indicates moderate severity, while the EPSS score of less than 1% and absence from CISA’s KEV catalog suggest a low likelihood of active exploitation. No publicly available exploit or evidence of ongoing attacks is documented, and the attack vector is not specified in the advisory, so the vulnerability may require local or privileged access to a target device. The risk to user privacy remains until devices are updated.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.7.11
`0`	affected	< 26.6.1

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 15.8
`0`	affected	< 26.6.2

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 27

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 27

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 27

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::

No data.

Vendor Product Versions

Apple

Ios And Ipados

Version	Status	Scheme	Platform
`[0,26.6.1)`	affected	semver	—

Apple

Macos

Version	Status	Scheme	Platform
`[0,26.6.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install iOS 26.6.1, iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, or watchOS 27 to fix the logic flaw.
Restrict or remove third‑party applications that may read sensitive data by limiting permissions or uninstalling untrusted apps.
Monitor device logs and application behavior for signs of unauthorized data disclosure, especially from recently installed or updated apps.

Generated by OpenCVE AI on October 27, 2026 at 01:40 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.152% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://support.apple.com/en-us/148281
https://support.apple.com/en-us/148282
https://support.apple.com/en-us/149036
https://support.apple.com/en-us/149037
https://support.apple.com/en-us/149038
https://support.apple.com/en-us/149043
https://support.apple.com/en-us/149225

History

Oct 27, 2026 4:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Logic flaw enabling applications to leak sensitive user information on Apple platforms

Oct 26, 2026 9:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	A logic issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to leak sensitive user information.	A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to leak sensitive user information.
References		https://support.apple.com/en-us/149225

Sep 21, 2026 7:30 AM Title updated View changes

Type	Values Removed	Values Added
Title	Logic Issue Potentially Exposing Sensitive Data in Apple iOS, iPadOS, and macOS

Sep 14, 2026 9:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	A logic issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to leak sensitive user information.	A logic issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to leak sensitive user information.
References		https://support.apple.com/en-us/149036 https://support.apple.com/en-us/149037 https://support.apple.com/en-us/149038 https://support.apple.com/en-us/149043

Aug 18, 2026 8:30 PM Title updated View changes

Type	Values Removed	Values Added
Title		Logic Issue Potentially Exposing Sensitive Data in Apple iOS, iPadOS, and macOS

Aug 18, 2026 7:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple ipados Apple iphone Os
CPEs		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos::::::::
Vendors & Products		Apple ipados Apple iphone Os

Aug 18, 2026 6:45 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Logic flaw in Apple OS allows app to leak sensitive user information
Weaknesses	CWE-200

Aug 18, 2026 2:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-693
Metrics		cvssV3_1 `{'score': 5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 18, 2026 12:15 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Logic flaw in Apple OS allows app to leak sensitive user information
Weaknesses		CWE-200

Aug 17, 2026 11:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos
Vendors & Products		Apple Apple ios And Ipados Apple macos

Aug 17, 2026 9:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		A logic issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to leak sensitive user information.
References		https://support.apple.com/en-us/148281 https://support.apple.com/en-us/148282