CVE-2025-46288

Published: Dec 17, 2025Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An app may be able to access sensitive payment tokens.

Affected (5)

Products: Apple: Ipados, Iphone Os, Macos, Visionos, Watchos

5 products

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	Before 26.2
Apple Iphone Os	Before 26.2
Apple Macos	Before 26.2
Apple Visionos	Before 26.2
Apple Watchos	Before 26.2

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (4)

https://support.apple.com/en-us/125884

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/en-us/125886

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/en-us/125890

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/en-us/125891

Source: product-security@apple.com

Release NotesVendor Advisory

Timeline

No history available yet.