Product:
Live Caller ID
Summary
A logic issue was addressed with improved checks. This issue could lead to the leakage of identifying information to app extensions when the Live Caller ID app extensions are turned off. The problem has been fixed in iOS 26.3 and iPadOS 26.3.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-20638 |
Exploitation
To exploit this vulnerability, an attacker would need to have access to a device with the Live Caller ID app extensions disabled. By leveraging this condition, the attacker could potentially access sensitive identifying information that should not be available to the extensions.
Affected Products
- iOS 26.3: The latest version of Apple’s mobile operating system that addresses the logic issue.
- iPadOS 26.3: The latest version of Apple’s operating system for iPads that resolves the vulnerability.
Mitigation
To mitigate this issue, users should ensure that they update their devices to iOS 26.3 or iPadOS 26.3. Additionally, users should review their app extension settings to ensure that sensitive information is not inadvertently exposed.