CVE-2026-20645
Inconsistent UI State Vulnerability in iOS/iPadOS Exposes Data
Publication date: 2026-02-11
Last updated on: 2026-04-02
Assigner: Apple Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apple | ipados | to 18.7.5 (exc) |
| apple | ipados | From 26.0 (inc) to 26.3 (exc) |
| apple | iphone_os | to 18.7.5 (exc) |
| apple | iphone_os | From 26.0 (inc) to 26.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1021 | The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an inconsistent user interface issue related to state management on Apple devices running iOS and iPadOS. It has been addressed and fixed in specific versions of these operating systems.
The issue could allow an attacker with physical access to a locked device to potentially view sensitive user information.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow someone with physical access to your locked iOS or iPadOS device to view sensitive information without unlocking the device.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update your device to the fixed versions of the operating system: iOS 26.3, iPadOS 26.3, iOS 18.7.5, or iPadOS 18.7.5.
Since the vulnerability allows an attacker with physical access to a locked device to view sensitive information, ensure that physical access to your devices is restricted until the update is applied.