CVE-2026-112707 in iOS
Summary
by MITRE • 10/26/2026
A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to identify what other apps a user has installed.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability described represents a privacy leakage flaw where an application could potentially infer the presence of other applications installed on a device by analyzing sensitive data that was previously accessible in unprotected locations. This type of issue is commonly categorized under CWE-200, which refers to Information Exposure, specifically involving the exposure of system configuration or user environment details that should remain private. In mobile operating systems like iOS and iPadOS, apps operate within strict sandboxing boundaries designed to prevent unauthorized access to data belonging to other applications or the system itself. However, when sensitive metadata such as installed application lists is stored in accessible directories or exposed through APIs without proper restrictions, it creates an avenue for enumeration attacks.
From a technical perspective, this flaw likely stems from improper handling of file permissions or API usage where an app could query bundle identifiers, URL schemes, or other unique markers associated with third-party applications. By detecting these signatures, malicious actors can build a profile of the user's digital footprint, including their professional tools, financial apps, health trackers, and communication platforms. This information is highly valuable for targeted social engineering attacks, such as spear-phishing campaigns tailored to specific users based on their software usage patterns. It also aids in fingerprinting devices with high precision, which can be used to bypass security controls or track user activity across different services without explicit consent.
The operational impact of this vulnerability extends beyond simple privacy concerns. Attackers leveraging this flaw could correlate installed applications with known vulnerabilities associated with those specific apps. For instance, if a device is found to have an outdated version of a banking app or a vulnerable messaging platform, the attacker can prioritize exploits targeting those specific weaknesses. This significantly lowers the barrier for successful compromise and increases the likelihood of data exfiltration or unauthorized access to sensitive personal information. Furthermore, this capability undermines user trust in the operating system's ability to protect privacy, which is a core promise of modern mobile platforms.
Apple addressed this issue by moving the relevant sensitive data to a protected location within the file system architecture, ensuring that only authorized processes with appropriate entitlements can access it. This fix was implemented in iOS 26.7.2 and iPadOS 26.7.2, as well as iOS 27.2 and iPadOS 27.2. The remediation aligns with the principle of least privilege, restricting data visibility to only those components that strictly require it for core functionality. Users are strongly advised to update their devices immediately to mitigate this risk. Additionally, developers should review their app permissions and ensure they do not attempt to enumerate installed applications through indirect means such as URL scheme probing or file system inspection, adhering to ATT&CK technique T1592.004, which involves gathering victim host information via software discovery methods that are now blocked by the updated OS protections.