Executive brief
iOS and iPadOS include a file system path validation component that failed to properly restrict app access to protected system files. An attacker could exploit this by crafting a malicious app that modifies critical system files, potentially compromising device security, user data, or app functionality. Apple patched this in iOS 26.7, iPadOS 26.7, iOS 27, and iPadOS 27.
Technical details
A path traversal or validation bypass vulnerability in iOS and iPadOS file system handling allowed sandboxed applications to access and modify protected file system paths. The issue stems from insufficient path validation logic that failed to properly enforce sandbox restrictions on file operations. The attack requires a malicious app to be installed on the device (local attack vector). An attacker can modify protected system files, potentially leading to privilege escalation, data tampering, or system compromise. The vulnerability is fixed in iOS 26.7, iPadOS 26.7, iOS 27, and iPadOS 27 through improved path validation.
Affected products
- Apple iOS before 26.7 and before 27
- Apple iPadOS before 26.7 and before 27
- Apple visionOS before 27
Timeline
- 2026-09-14: patched: Fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27
- 2026-09-14: disclosed