Product:
iOS and iPadOS
Summary
An inconsistent user interface issue was addressed with improved state management. An attacker with physical access to a locked device may be able to view sensitive user information. This issue is fixed in the latest versions of iOS and iPadOS.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.6 | CVE-2026-20645 |
Exploitation
To exploit this vulnerability, an attacker must have physical access to a locked device. By manipulating the user interface, the attacker may gain access to sensitive user information that should otherwise be protected. This can lead to unauthorized disclosure of personal data.
Affected Products
- iOS 26.3 – Fixed an issue with state management that could allow sensitive information exposure.
- iPadOS 26.3 – Similar fix as iOS, addressing the same user interface inconsistency.
- iOS 18.7.5 – Addressed the vulnerability in this version to prevent unauthorized access.
- iPadOS 18.7.5 – Mitigated the risk of sensitive information exposure in this version.
Mitigation
To mitigate this vulnerability, users should ensure their devices are updated to the latest versions of iOS and iPadOS. Regularly updating devices helps protect against known vulnerabilities and enhances overall security.