CVE-2026-84513

Undergoing Analysis Undergoing Analysis - In Progress

Privacy Data Leak in Apple iOS and macOS

Publication date: 2026-09-14

Last updated on: 2026-09-18

Assigner: Apple Inc.

Description

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A malicious application may be able to determine a user's current location.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-18

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-03

NVD

CVE-2026-84513

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 26.7 (exc)
apple	iphone_os	to 26.7 (exc)
apple	macos	From 15.0 (inc) to 15.8 (exc)
apple	macos	From 26.0 (inc) to 26.7 (exc)
apple	visionos	to 27.0 (exc)
apple	watchos	to 27.0 (exc)
apple	tvos	to 27.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a privacy issue where log entries did not properly redact private data. A malicious app could exploit this to determine a user's current location by analyzing the logs.

Detection Guidance

This vulnerability involves private data redaction in log entries. Detection would require checking log files for unredacted location data. Review system logs for entries related to location services or privacy-sensitive data. Look for applications accessing location services without proper redaction in logs.

Impact Analysis

If exploited, an attacker could track your real-time location without your knowledge. This could lead to privacy breaches, stalking, or targeted attacks based on your movements.

Compliance Impact

The vulnerability involves a privacy issue where a malicious application may determine a user's current location through log entries. This could lead to unauthorized access to sensitive personal data, potentially violating GDPR's principles of data minimization and user consent, as well as HIPAA's requirements for protecting health information if location data is linked to such records.

Mitigation Strategies

Update affected Apple devices to the latest versions (iOS 26.7/27, macOS Golden Gate 27, etc.) to apply the privacy fix. Avoid installing untrusted applications that request excessive location permissions. Monitor logs for suspicious access to location data.

Hi! I’m here to help you understand CVE-2026-84513. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70