Product:
iOS and iPadOS
Summary
A logic issue was addressed with improved state management. An attacker may be able to discover a user’s deleted notes. This issue is fixed in iOS 26.3 and iPadOS 26.3, iOS 18.7.5 and iPadOS 18.7.5.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2026-20682 |
Exploitation
To exploit this vulnerability, an attacker would need to be on the same network as the target device. By sending specially crafted network requests, the attacker could potentially access deleted notes that should not be retrievable. This requires low complexity and no user interaction, making it a significant risk.
Affected Products
- iOS 26.3 – Fixed logic issue with improved state management.
- iPadOS 26.3 – Addressed the same logic issue as iOS.
- iOS 18.7.5 – Contains the fix for the vulnerability.
- iPadOS 18.7.5 – Also includes the resolution for the identified issue.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of iOS and iPadOS as soon as possible. Keeping software up to date is crucial in protecting against potential exploits and ensuring that security improvements are applied.