Apple DeviceLink Directory Path Parsing Vulnerability Allowing Access to Sensitive User Data

A vulnerability exists in the DeviceLink component of multiple Apple operating systems, including iOS, iPadOS, macOS Sequoia, macOS Sonoma, and visionOS. This vulnerability arises from a parsing issue in the handling of directory paths, which may allow an application to access sensitive user data. The issue has been addressed with improved path validation.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive user data by applications.

Remediation

Users can update to iOS 18.7.7, iPadOS 18.7.7, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, or visionOS 26.4 to address this vulnerability.