{"id":"CVE-2026-84614","kind":"vulnerability","aliases":["CVE-2026-84614"],"related":[],"title":"Apple iOS and iPadOS: lock screen exposes contacts to someone with physical access","description":"A logic issue was addressed with improved checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An attacker with physical access may be able to access contacts from the lock screen.","summary":"Apple's iOS and iPadOS have a logic flaw that lets a person with physical access read contacts from the lock screen. The fix is in iOS 26.7.2, iPadOS 26.7.2, iOS 27 and iPadOS 27.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","ios","ipados","other"],"not_affected_if":["physical-access-controlled"],"how_to_check":"- Check the device version under Settings > General > About; the sources do not give a command.\n- unknown for any other check","fix":"- Update iOS and iPadOS to `26.7.2` or later, or to iOS 27 and iPadOS 27.","status":"open","published_at":"2026-10-26T21:20:17+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","triaged_at":"2026-10-26T21:57:05+00:00","updated_at":"2026-10-26T21:57:05+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-26T21:57:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `26.7.2` or later, or to iOS 27 and iPadOS 27.","reach":"local","title":"Apple iOS and iPadOS: lock screen exposes contacts to someone with physical access","impact":"low","summary":"Apple's iOS and iPadOS have a logic flaw that lets a person with physical access read contacts from the lock screen. The fix is in iOS 26.7.2, iPadOS 26.7.2, iOS 27 and iPadOS 27.","category":"other","nicknames":[],"who_cares":["ios","ipados","apple-devices"],"confidence":0.6,"needs_auth":"no","worst_case":"Contacts readable from a locked device by someone holding it","analyst_note":"Check Apple's security notes for CVE-2026-84614 to confirm affected models and whether the lock screen exposure needs a specific setting.","how_to_check":"- Check the device version under Settings > General > About; the sources do not give a command.\n- unknown for any other check","needs_analyst":true,"not_affected_if":["physical-access-controlled"],"who_is_affected":"Owners of iPhones and iPads running iOS or iPadOS builds older than the fixed versions. The sources describe a physical-access attack on the lock screen and do not say which models or configurations are affected. Devices already on the fixed versions are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000581,"input_tokens":3270,"output_tokens":507,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-84614':16A,19A '26.7.2':52B,54B,74C,77C '27':56B,59B,79C,82C 'abl':90C 'access':13A,40B,87C,92C 'address':64C 'appl':1A,21B,25B 'apple-devic':20B 'attack':84C 'check':67C 'contact':8A,42B,93C 'cve':14A,17A 'devic':22B 'expos':7A 'fix':48B,71C 'flaw':33B 'improv':66C 'io':2A,23B,27B,51B,55B,73C,78C 'ipado':4A,24B,29B,53B,58B,76C,81C 'issu':62C,69C 'let':35B 'lock':5A,45B,96C 'logic':32B,61C 'may':88C 'person':37B 'physic':12A,39B,86C 'read':41B 'screen':6A,46B,97C 'someon':10A","nicknames":[],"mitigations":[],"who_affected":"Owners of iPhones and iPads running iOS or iPadOS builds older than the fixed versions. The sources describe a physical-access attack on the lock screen and do not say which models or configurations are affected. Devices already on the fixed versions are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:20:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84614","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84614","severity":null,"published_at":"2026-10-26T21:20:17+00:00","modified_at":"2026-10-26T21:20:17+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","fetched_at":"2026-10-26T21:55:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}