Product:
iOS
Summary
An authorization issue was addressed with improved state management. An attacker with physical access to a locked device may be able to view sensitive user information. This issue is fixed in the latest versions of iOS and iPadOS.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.6 | CVE-2026-20661 |
Exploitation
To exploit this vulnerability, an attacker must have physical access to a locked device. By manipulating the state management of the device, the attacker can potentially bypass security measures and access sensitive user information without needing any privileges or user interaction.
Affected Products
- iOS 26.3 – Latest version addressing the authorization issue.
- iPadOS 26.3 – Latest version addressing the authorization issue.
- iOS 18.7.5 – Previous version with the vulnerability.
- iPadOS 18.7.5 – Previous version with the vulnerability.
Mitigation
To mitigate this issue, users should update their devices to the latest versions of iOS and iPadOS. Regularly updating devices ensures that known vulnerabilities are patched and reduces the risk of exploitation.