CVE-2026-64761: Apple iPadOS Information Disclosure Flaw

CVE-2026-64761 Overview

CVE-2026-64761 is an information disclosure vulnerability in Apple iOS and iPadOS. The flaw allows an installed application to enumerate other apps present on the device. Apple addressed the issue in iOS 27 and iPadOS 27 through improved handling of user preferences. The weakness maps to [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

The vulnerability undermines the app sandbox privacy boundary that prevents third-party apps from fingerprinting a user's installed software inventory. Attackers can leverage this data for profiling, targeted phishing, or supply-chain reconnaissance.

Critical Impact
A malicious or curious app can silently enumerate other installed apps, enabling user fingerprinting and targeted follow-on attacks against iOS and iPadOS users.

Affected Products

Apple iOS prior to version 27
Apple iPadOS prior to version 27
Third-party applications running on unpatched iOS/iPadOS builds

Discovery Timeline

2026-09-14 - CVE-2026-64761 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-64761

Vulnerability Analysis

The vulnerability resides in how iOS and iPadOS expose user preferences to sandboxed applications. An app can query preference state that reflects the presence of other installed applications on the device. This bypasses Apple's designed privacy boundary, which restricts third-party visibility into the installed app inventory.

Apple's documented mechanism for querying other apps requires declaring LSApplicationQueriesSchemes in Info.plist and is limited by design. This flaw provides an indirect signal that circumvents that control. The result is unauthorized enumeration of installed software without user consent or platform prompts.

Root Cause

The root cause is improper handling of user preferences accessible to third-party apps. Preference values leak state that correlates with the installation of specific apps. Apple's fix in iOS 27 and iPadOS 27 hardens how these preferences are surfaced to reduce cross-app inference.

Attack Vector

Exploitation requires a malicious or over-privileged app installed on the device. Once running, the app queries preference APIs to infer which other apps exist on the device. No user interaction beyond initial app installation is required, and no elevated entitlements are needed. Harvested inventories can be transmitted to a remote server for profiling.

No public proof-of-concept exploit code is available. The Apple security advisory describes the fix in general terms without disclosing exploitation specifics.

Detection Methods for CVE-2026-64761

Indicators of Compromise

Third-party apps making unusual volumes of preference or URL scheme queries at launch
Outbound network traffic from mobile apps containing structured lists of application identifiers or bundle IDs
Mobile Device Management (MDM) telemetry showing devices running iOS or iPadOS below version 27

Detection Strategies

Review App Store and enterprise app inventories for apps that request broad LSApplicationQueriesSchemes entries beyond their stated function
Use mobile threat defense tooling to flag apps performing installed-app fingerprinting behavior
Correlate MDM version telemetry with the fixed builds (iOS 27, iPadOS 27) to identify exposed devices

Monitoring Recommendations

Ingest MDM and mobile threat defense logs into a centralized analytics platform for OS version and app behavior monitoring
Track outbound connections from managed mobile devices to unknown analytics or advertising endpoints
Alert on newly sideloaded or enterprise-signed apps deployed outside approved channels

How to Mitigate CVE-2026-64761

Immediate Actions Required

Update all iPhone and iPad devices to iOS 27 or iPadOS 27 without delay
Enforce minimum OS version compliance policies through MDM to block noncompliant devices from corporate resources
Audit installed applications on managed devices and remove apps from untrusted publishers

Patch Information

Apple fixed CVE-2026-64761 in iOS 27 and iPadOS 27 by improving how user preferences are handled. Details are provided in the Apple Support Article. Administrators should push the update through Automated Device Enrollment and MDM software update policies.

Workarounds

Restrict installation of nonessential third-party apps on corporate-owned devices until updates are applied
Limit sensitive workflows on devices that cannot yet be upgraded to iOS 27 or iPadOS 27
Educate users about the privacy implications of installing apps from unknown publishers

bash

# Example MDM compliance policy pseudo-configuration
minimum_os_version:
  ios: "27.0"
  ipados: "27.0"
action_on_noncompliance: block_corporate_access