Executive brief
A security vulnerability in Apple iOS and iPadOS could allow a malicious application to modify protected parts of the device's file system. This issue stems from a race condition, which is a timing error in how the system handles file operations. If exploited, an app could potentially tamper with system files or data that should normally be inaccessible, compromising the integrity of the device.
Technical details
A race condition was identified in the file system handling of iOS and iPadOS. The vulnerability exists due to insufficient checks during concurrent file operations, allowing an application to bypass file system protections. An attacker would need to have a malicious app running on the target device to exploit this flaw. By successfully winning the race condition, the app can gain unauthorized write access to protected directories. Apple addressed this issue in iOS 26.6 and iPadOS 26.6 by implementing improved validation checks.
Affected products
- Apple iOS Before 26.6
- Apple iPadOS Before 26.6
Timeline
- 2026-07-27: disclosed
- 2026-07-27: patched: Fixed in iOS 26.6 and iPadOS 26.6