{"id":"CVE-2026-112609","kind":"vulnerability","aliases":["CVE-2026-112609"],"related":[],"title":"Apple iOS and iPadOS: app can access sensitive user data","description":"This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.","summary":"Apple's iOS 27.2 and iPadOS 27.2 fix a flaw that lets an app reach sensitive user data it should not see. The sources give no further technical detail about the component or the trigger.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","ios","ipados","other"],"not_affected_if":["already-on-ios-27.2"],"how_to_check":"- Check the device version under Settings > General > About; `iOS 27.2` or `iPadOS 27.2` or later is patched\n- unknown for any other check, as the sources do not say","fix":"- Update iPhone and iPad to `iOS 27.2` or `iPadOS 27.2` or later\n- unknown for any other action, as the sources do not say","status":"open","published_at":"2026-10-26T21:17:53+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","triaged_at":"2026-10-26T21:27:28+00:00","updated_at":"2026-10-26T21:27:28+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-26T21:27:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update iPhone and iPad to `iOS 27.2` or `iPadOS 27.2` or later\n- unknown for any other action, as the sources do not say","reach":"local","title":"Apple iOS and iPadOS: app can access sensitive user data","impact":"medium","summary":"Apple's iOS 27.2 and iPadOS 27.2 fix a flaw that lets an app reach sensitive user data it should not see. The sources give no further technical detail about the component or the trigger.","category":"other","nicknames":[],"who_cares":["ios","ipados","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A malicious app reads sensitive user data on the device","analyst_note":"Check Apple's iOS 27.2 security notes for the component, the trigger and whether the attack needs a malicious app installed; the NVD entry gave no detail.","how_to_check":"- Check the device version under Settings > General > About; `iOS 27.2` or `iPadOS 27.2` or later is patched\n- unknown for any other check, as the sources do not say","needs_analyst":true,"not_affected_if":["already-on-ios-27.2"],"who_is_affected":"Owners of iPhones and iPads running iOS or iPadOS releases before 27.2 are affected. The sources do not say which apps or configurations are needed to exploit it, so the exposure window is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000585,"input_tokens":3238,"output_tokens":522,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112609':13A,16A '-2026':12A,15A '27.2':25B,28B,70C,73C 'abl':78C 'access':7A,80C 'address':60C 'app':5A,35B,75C 'appl':1A,18B,22B 'apple-devic':17B 'check':63C 'compon':53B 'cve':11A,14A 'data':10A,39B,83C 'detail':50B 'devic':19B 'fix':29B,67C 'flaw':31B 'give':46B 'improv':62C 'io':2A,20B,24B,69C 'ipado':4A,21B,27B,72C 'issu':58C,65C 'let':33B 'may':76C 'reach':36B 'see':43B 'sensit':8A,37B,81C 'sourc':45B 'technic':49B 'trigger':56B 'user':9A,38B,82C","nicknames":[],"mitigations":[],"who_affected":"Owners of iPhones and iPads running iOS or iPadOS releases before 27.2 are affected. The sources do not say which apps or configurations are needed to exploit it, so the exposure window is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112609","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112609","severity":null,"published_at":"2026-10-26T21:17:53+00:00","modified_at":"2026-10-26T21:17:53+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","fetched_at":"2026-10-26T21:20:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}