CVE-2026-20638: iOS/iPadOS Information Disclosure Bug

CVE-2026-20638 Overview

CVE-2026-20638 is an information leakage vulnerability affecting Apple's iOS and iPadOS operating systems. The flaw stems from a logic issue in the handling of Live Caller ID app extensions where user privacy settings are not properly enforced. When a user has explicitly disabled Live Caller ID extensions, identifying information could still be leaked to these extensions due to improper access control checks.

This vulnerability represents a failure in the privacy boundary enforcement mechanisms within iOS and iPadOS, potentially exposing sensitive caller identification data to third-party extensions even when users have intentionally opted out of such functionality.

Critical Impact

Users who disabled Live Caller ID extensions for privacy reasons may have had their identifying information exposed to those same extensions, undermining user consent and privacy controls.

Affected Products

• iOS 26.3 and earlier versions
• iPadOS 26.3 and earlier versions

Discovery Timeline

• 2026-02-11 - CVE-2026-20638 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-20638

Vulnerability Analysis

This vulnerability is classified under CWE-284 (Improper Access Control), indicating a fundamental weakness in how the operating system enforces access boundaries between user privacy settings and app extension behavior.

The core issue lies in the logic that determines whether Live Caller ID extensions should receive caller information. Even when users explicitly configure their devices to prevent these extensions from accessing identifying data, the system fails to properly enforce this restriction. This represents a broken access control scenario where the configured security policy does not match the actual runtime behavior.

The attack requires local access and user interaction, meaning an attacker would need to have a malicious or compromised Live Caller ID extension already installed on the target device. The vulnerability does not allow for remote exploitation but could be leveraged by app developers who create extensions that collect data beyond what users have consented to share.

Root Cause

The root cause is a logic flaw in the access control checks that govern data flow between the iOS/iPadOS system services and Live Caller ID app extensions. When the system processes incoming call information, it fails to properly validate the user's privacy preferences before passing identifying information to registered extensions. This indicates a missing or improperly implemented permission check in the extension communication pathway.

Attack Vector

The attack vector is local, requiring the attacker to have a Live Caller ID extension installed on the victim's device. The exploitation scenario involves:

1. A user installs a Live Caller ID extension (potentially malicious or compromised)
2. The user subsequently disables the extension in privacy settings, believing their data is protected
3. Despite the disabled setting, the extension continues to receive identifying caller information
4. The extension can collect, store, or exfiltrate this data without the user's knowledge or consent

The vulnerability requires user interaction in the sense that the user must receive incoming calls for the information leakage to occur. The attacker cannot directly trigger the data exposure but can passively collect information once their extension is installed.

Detection Methods for CVE-2026-20638

Indicators of Compromise

• Unusual network activity from Live Caller ID extensions sending data when supposedly disabled
• Extension processes accessing caller identification APIs despite being marked as disabled in user settings
• Log entries showing extension callbacks for call events when extensions should be inactive
• Unexpected data storage or transmission patterns from installed Live Caller ID extensions

Detection Strategies

• Monitor extension behavior for API calls that should be blocked based on user privacy settings
• Implement network traffic analysis to detect data exfiltration from disabled extensions
• Review installed extensions and verify their behavior matches configured privacy settings
• Audit system logs for discrepancies between extension permissions and actual data access patterns

Monitoring Recommendations

• Enable detailed logging for extension activity on managed iOS/iPadOS devices
• Implement Mobile Device Management (MDM) solutions to monitor and control extension installations
• Review extension permissions periodically through device management platforms
• Establish baseline network behavior for extensions to identify anomalous data transmission

How to Mitigate CVE-2026-20638

Immediate Actions Required

• Update all iOS devices to iOS 26.3 with the latest security patches applied
• Update all iPadOS devices to iPadOS 26.3 with the latest security patches applied
• Review and remove any untrusted Live Caller ID extensions until patches are applied
• Audit installed extensions and their current permission states

Patch Information

Apple has addressed this vulnerability in iOS 26.3 and iPadOS 26.3 through improved logic checks in the extension permission enforcement system. The patch ensures that when users disable Live Caller ID extensions, the system properly blocks identifying information from being shared with those extensions.

For detailed patch information and update instructions, refer to the Apple Security Advisory.

Users and administrators should apply updates through:

• Settings > General > Software Update on individual devices
• MDM platforms for enterprise-managed device fleets
• Apple Configurator for supervised devices

Workarounds

• Remove all Live Caller ID extensions until the device can be updated to the patched version
• Disable Live Caller ID functionality entirely at the system level if extension removal is not feasible
• Use MDM policies to prevent installation of Live Caller ID extensions on managed devices
• Monitor extension behavior manually by reviewing extension activity in Settings > Privacy