This issue was addressed with improved input validation.

iOS and iPadOS · Improper input validation · CWE-20

AffectediOS and iPadOS, macOS

FixUpdate to 27.2 or newer

PublishedOct 26, 20:34 · apple

Scored5.5 · CISA

Exploit code publicNone known · checked 22:18 UTC

ExploitedNone known · CISA KEV checked 22:30 UTC

What we know

No known exploitation. CISA KEV, checked 22:30 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.

An attacker needs local access to the machine. CVSS: local.

A successful attack can read data. CVSS impact.

Description

This issue was addressed with improved input validation. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2. An app may be able to access sensitive user data.

From apple

Affected and fixed versions

ProductAffectedFixed iniOS and iPadOSbefore 27.227.2macOSbefore 27.227.2

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

support.apple.com/en-us/149230 · support.apple.com support.apple.com/en-us/149521 · support.apple.com

Other CVEs in iOS and iPadOS

All 1,549 →

5.5An authorization issue was addressed with improved state management. · CVE-2026-86925Oct 26 –A buffer overflow was addressed with improved bounds checking. · CVE-2026-84627Oct 26 –A buffer overflow was addressed with improved size validation. · CVE-2026-86972Oct 26