CVE-2026-86883

Improper Privacy Safeguards Allow File-Based Information Disclosure in Apple iOS, iPadOS, and visionOS

View on CVE.org
Published Sep 14, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Description
A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27. An app may be able to access sensitive user data.

Analysis

AI-generated

Technical impact

The vulnerability arises from incomplete privacy safeguards in the file‑handling routines of Apple’s operating systems. When an application writes or opens certain files, it can read data that it is not authorized to access, exposing sensitive user information. This flaw fits the CWE‑200 classification of improper information disclosure.

Affected Systems

All releases of Apple iOS, iPadOS, and visionOS before version 27 are affected. The issue has been addressed in iOS 27, iPadOS 27, and visionOS 27.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate risk, and the EPSS score of less than 1 % implies a low probability of widespread exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers are likely limited to local mobile applications or contexts where an app has permission to place and read protected files; no remote exploitation vector has been documented. The impact is restricted to confidentiality and does not appear to affect integrity or availability.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the device to iOS 27, iPadOS 27, or visionOS 27 or later to apply the vendor fix.
  • Limit the file‑access permissions granted to third‑party applications to the minimum required for their functionality, following least‑privilege policies.
  • Monitor system logs and application behavior for unexpected file reads that could indicate exploitation of the file‑handling routine.

Generated by OpenCVE AI on September 20, 2026 at 18:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Improper Privacy Safeguards Allow File-Based Information Disclosure in Apple iOS, iPadOS, and visionOS
Type Values Removed Values Added
Title Privacy Issue in File Handling Allows Apps to Access Sensitive User Data on Apple iOS, iPadOS, and visionOS
Type Values Removed Values Added
Title Privacy Issue in File Handling Allows Apps to Access Sensitive User Data on Apple iOS, iPadOS, and visionOS
Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os
Type Values Removed Values Added
Weaknesses CWE-200
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple visionos
Vendors & Products Apple
Apple ios And Ipados
Apple visionos
Type Values Removed Values Added
Description A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27. An app may be able to access sensitive user data.
References
Earlier changes (2)
Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

Sources

Status
PUBLISHED
Assigner
apple
Published
Updated
Oct 26, 2026, 8:43 PM
Reserved
Sep 8, 2026, 4:43 PM

View source JSON

Updated
Sep 15, 2026, 5:54 PM

JSON

Status
Analyzed
Published
Sep 14, 2026, 9:17 PM
Modified
Sep 16, 2026, 1:04 AM

View source JSON

No data.

Updated
Sep 20, 2026, 6:15 PM

JSON