CVE-2026-43797: Apple iPadOS Information Disclosure Flaw

CVE-2026-43797 Overview

CVE-2026-43797 is an information disclosure vulnerability affecting Apple iOS, iPadOS, and macOS. The flaw allows an application to access information about a user's contacts without proper authorization. Apple addressed the issue with improved checks in iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6. The vulnerability is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
An installed application can read a user's contacts data, exposing personally identifiable information (PII) without the user's consent.

Affected Products

Apple iOS (prior to 26.6)
Apple iPadOS (prior to 26.6)
Apple macOS Tahoe (prior to 26.6)

Discovery Timeline

2026-07-27 - CVE-2026-43797 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-43797

Vulnerability Analysis

The vulnerability allows an app installed on a vulnerable Apple device to access contact information belonging to the user. Contacts data is protected by the Apple privacy framework, which requires user consent through the Transparency, Consent, and Control (TCC) mechanism. This flaw bypasses those protections, giving an application read access to contact records without an authorization prompt.

Apple's advisory states the issue was addressed with improved checks, indicating that a validation step within the contacts access path did not adequately verify caller entitlements or user consent state. The vulnerability requires local access, meaning an attacker must deliver and run code on the target device, typically through a malicious or compromised application. User interaction is required, consistent with the need for an application to be installed and launched.

Root Cause

The root cause is missing or insufficient checks in the API path that serves contact information. Access control logic did not confirm that the calling app held the required entitlement or that the user had granted access. Apple's fix introduces additional checks to enforce these prerequisites before returning contact records.

Attack Vector

An attacker distributes an application through legitimate or sideloading channels. Once launched by the victim, the app invokes the contacts subsystem and receives records that should be gated behind explicit user consent. The impact is limited to confidentiality of contacts data; the flaw does not permit modification or denial of service. See the Apple Security Advisory 128066 and Apple Security Advisory 128067 for vendor details.

Detection Methods for CVE-2026-43797

Indicators of Compromise

Applications making unexpected calls to the Contacts framework without a corresponding TCC prompt shown to the user.
Outbound network traffic from third-party apps containing serialized contact records, email addresses, or phone number lists.
Devices running iOS, iPadOS, or macOS Tahoe versions earlier than 26.6 with newly installed or sideloaded applications.

Detection Strategies

Audit installed applications on managed devices and correlate their declared entitlements against observed data access patterns.
Inspect MDM telemetry for OS build strings to identify endpoints running versions prior to 26.6.
Review App Sandbox and TCC logs on macOS for contact access events that lack an approved consent record.

Monitoring Recommendations

Enable enterprise MDM reporting on OS version compliance and flag devices below the patched build.
Monitor network egress from mobile endpoints for high-volume PII exfiltration patterns.
Track third-party application inventories and vet apps requesting contacts entitlements before deployment.

How to Mitigate CVE-2026-43797

Immediate Actions Required

Update all affected devices to iOS 26.6, iPadOS 26.6, or macOS Tahoe 26.6 as soon as possible.
Enforce OS version compliance policies through Mobile Device Management (MDM) to block or quarantine devices running vulnerable builds.
Review installed applications and remove any untrusted or sideloaded apps that request access to the Contacts framework.

Patch Information

Apple released fixes in iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6. Refer to Apple Security Advisory 128066 and Apple Security Advisory 128067 for the complete list of addressed issues and update instructions.

Workarounds

Restrict application installation to vetted sources managed through corporate MDM until patching is complete.
Use configuration profiles to deny contacts access entitlements for non-essential applications where supported.
Educate users to decline contacts permission requests from unfamiliar applications.

bash

# Verify device OS build via MDM or terminal
sw_vers -productVersion   # macOS: confirm version reports 26.6 or later
# iOS/iPadOS: Settings > General > About > Software Version (must be 26.6+)