Product:
iOS
Summary
An authorization issue was addressed with improved state management. An attacker with physical access to a locked device may be able to view sensitive user information. This issue is fixed in iOS 26.3 and iPadOS 26.3, iOS 18.7.5 and iPadOS 18.7.5.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-20655 |
Exploitation
To exploit this vulnerability, an attacker must have physical access to a locked device. By manipulating the state management of the device, the attacker can potentially gain access to sensitive user information without needing to unlock the device.
Affected Products
- iOS 26.3 – Fixed authorization issue with improved state management.
- iPadOS 26.3 – Fixed authorization issue with improved state management.
- iOS 18.7.5 – Fixed authorization issue with improved state management.
- iPadOS 18.7.5 – Fixed authorization issue with improved state management.
Mitigation
To mitigate this issue, users should update their devices to the latest versions of iOS or iPadOS as specified in the advisory. Keeping devices updated ensures that known vulnerabilities are patched and reduces the risk of exploitation.