CVE-2026-20663: Apple iPadOS Information Disclosure Flaw

CVE-2026-20663 Overview

CVE-2026-20663 is an information disclosure vulnerability affecting Apple iOS and iPadOS. The flaw allows an installed app to enumerate other apps installed on the device through unsanitized log entries. Apple addressed the issue by sanitizing logging output in iOS 18.7.5, iPadOS 18.7.5, iOS 26.3, and iPadOS 26.3. The vulnerability is categorized under [CWE-532] (Insertion of Sensitive Information into Log File). Exploitation requires local access with low privileges and no user interaction. While the impact is limited to confidentiality of installed app metadata, the data leak can support fingerprinting, targeted phishing, and reconnaissance for follow-on attacks.

Critical Impact
A locally installed app can enumerate the user's installed applications, enabling device fingerprinting and reconnaissance for targeted attacks.

Affected Products

Apple iOS versions prior to 18.7.5
Apple iPadOS versions prior to 18.7.5
Apple iOS versions prior to 26.3 and iPadOS versions prior to 26.3

Discovery Timeline

2026-02-11 - CVE-2026-20663 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-20663

Vulnerability Analysis

The vulnerability stems from sensitive information written to system logs without sanitization. On iOS and iPadOS, log streams accessible to sandboxed apps contained identifiers that revealed which other applications were installed on the device. An app reading these logs could enumerate installed apps without holding the entitlements normally required to query that information.

Apple's fix sanitizes the logging path so that installed-app identifiers no longer appear in log output reachable from a standard app context. The flaw maps to [CWE-532], the insertion of sensitive information into log files.

Root Cause

The root cause is improper handling of sensitive identifiers in log messages emitted by system components. Bundle identifiers or related metadata reached log streams accessible through normal logging APIs. App sandbox boundaries did not prevent this information from being read by other installed apps.

Attack Vector

Exploitation requires a locally installed app on the target device. The attacker app subscribes to or reads accessible log streams and parses entries to enumerate installed bundle identifiers. No user interaction is required. The resulting inventory of installed apps supports fingerprinting, targeted social engineering, and reconnaissance for vulnerabilities in specific installed applications. Apple's advisories for this issue are published as Apple Support Advisory #126346 and Apple Support Advisory #126347.

Detection Methods for CVE-2026-20663

Indicators of Compromise

Installed third-party apps subscribing to or repeatedly reading system log streams outside their normal operational scope.
Apps exhibiting outbound network activity carrying inventories of bundle identifiers or app metadata.
Unexpected privacy or diagnostics access patterns from non-system apps in MDM telemetry.

Detection Strategies

Review MDM and mobile threat defense telemetry for apps accessing diagnostic or log APIs without a clear functional reason.
Flag iOS and iPadOS devices reporting OS versions below 18.7.5 or 26.3 as exposed to this enumeration flaw.
Correlate app behavior with traffic analytics to surface apps exfiltrating installed-app inventories.

Monitoring Recommendations

Enforce OS version compliance policies through MDM and alert on devices missing the patched releases.
Monitor App Store and enterprise-distributed apps for permissions or behaviors inconsistent with declared purpose.
Track network destinations associated with mobile analytics SDKs known to harvest device inventory data.

How to Mitigate CVE-2026-20663

Immediate Actions Required

Update affected devices to iOS 18.7.5, iPadOS 18.7.5, iOS 26.3, or iPadOS 26.3 as appropriate for the device generation.
Push the update through MDM and set compliance rules that quarantine non-compliant devices from sensitive resources.
Audit installed apps on managed devices and remove apps from untrusted developers or with excessive diagnostic access.

Patch Information

Apple resolved CVE-2026-20663 by sanitizing log output so that installed-app identifiers are no longer exposed. Fixed versions are iOS 18.7.5, iPadOS 18.7.5, iOS 26.3, and iPadOS 26.3. Patch details are available in Apple Support Advisory #126346 and Apple Support Advisory #126347.

Workarounds

No vendor-supplied workaround exists; applying the patched OS release is the only remediation.
Restrict installation of non-essential third-party apps on devices handling sensitive data through MDM allowlists.
Educate users to avoid sideloaded or unfamiliar apps until devices are patched.

bash

# Configuration example: MDM compliance check for patched iOS/iPadOS versions
# Mark devices as non-compliant if OS version is below the fixed releases
minimum_ios_version_18x: "18.7.5"
minimum_ios_version_26x: "26.3"
action_on_noncompliance: "block_corporate_resources"