CVE-2026-43657

Executive Summary

CVE-2026-43657 is a local information disclosure vulnerability in Apple iOS and iPadOS that allows a malicious application to enumerate other applications installed on the device. The flaw stems from an insufficient permissions check that fails to restrict access to app installation data. A successful exploit requires local access with a valid app sandbox environment but no additional user interaction or elevated privileges beyond standard app permissions. The vulnerability is fixed in iOS 26.5 and iPadOS 26.5 by applying additional permission restrictions. Given the low CVSS score of 3.3 and the absence of public exploit code, this is a low-severity issue, but it enables privacy-relevant reconnaissance that could be chained with other vulnerabilities to amplify impact. Enterprise environments managing fleets of Apple devices should prioritize patching as part of routine maintenance cycles.

Technical Analysis

The NVD description states: "A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be able to enumerate installed apps."

Based on the CWE classification of CWE-269 (Improper Privilege Management) and the available description, this is an authorization policy flaw. The underlying mechanism involves the iOS application sandbox and its permission model. iOS apps are isolated in sandboxes and require explicit entitlements or user approval to access sensitive system resources. The vulnerability stems from a failure to properly enforce permission boundaries for an API or system service that exposes installed application metadata.

Vulnerability Mechanism (Class-Level):

At the class level, this is an improper privilege management issue where an application running with standard user-level privileges can query system services beyond its intended permission boundary. The specific API or system service affected is not disclosed in the NVD description. The permissions issue likely involves one of the following general mechanisms common in mobile operating systems:

1. Bridged API exposure — A private or semi-private API that should require a system entitlement was not properly gated, allowing a third-party app to call it from the sandbox.
2. Weak file-system permission enforcement — Application installation records stored in a system database or file-system location may have had overly permissive access controls.
3. Missing XPC message validation — A custom inter-process communication message from a malicious app was not validated against the expected calling process's entitlement set.

Attack Surface:

• Attack Vector: Local — the attacker must have a malicious app installed and executable on a device running a vulnerable iOS/iPadOS version.
• Attack Complexity: Low — no special conditions or race windows required; the app simply invokes the affected API.
• Privileges Required: Low — a standard third-party app with no special entitlements.
• User Interaction: None — the attack happens silently without user action.
• Impact Scope: Unchanged — the confidentiality impact is limited to the app enumeration data.

Affected Versions:

The patched versions are iOS 26.5 and iPadOS 26.5. Based on this, all versions prior to 26.5 on both platforms are presumed affected, though Apple's advisory does not break down exact affected version ranges. The NVD affected-version field is empty, meaning the specific lower-bound affected versions are not listed. As of the report date, insufficient detail is available to enumerate which older iOS/iPadOS releases are affected.

Patch Details:

Apple applied "additional restrictions" to address the permissions issue. No specific function, entitlements key, or API path is disclosed. Patch confidence is rated 2/4 (CLAIMED) — only NVD lists the patch, and it is not independently confirmed by an Apple security advisory mirror.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-43657 as of the report date. The attack chain is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance / Target Identification:

An attacker targets any iOS 26.x (pre-26.5) or iPadOS 26.x (pre-26.5) device. The attacker must first distribute and install a malicious or repackaged application on the target device. Since this is a local attack requiring low privileges, the attacker can accomplish this through:

• Social engineering to trick the user into installing an app from the official App Store (if the malicious payload was embedded in a benign-looking app submitted under false pretense).
• Enterprise distribution channels (MDM-signed apps) where users are provisioned with sideloaded applications.
• Supply-chain compromise of an existing legitimate app via a malicious SDK or third-party component.

Step 2 — Triggering the Vulnerability:

Once the malicious app is running on the target device, it invokes the affected system service or API that was not properly permission-gated. Because the permissions issue allows any app to access this service without additional entitlements, no special environment preparation is needed — the app simply calls the API during its execution or in response to a specific user action within the app.

Step 3 — Payload / Execution Method (Class-Level):

Given the CWE-269 classification, the execution method is an unauthorized access to a protected system resource. The payload is the list of installed applications (bundle identifiers, display names, and potentially version numbers) returned by the vulnerable API. Since this is an information disclosure at the class level, the "payload" is a data leak rather than code executed on the system.

The attacker's app retrieves the installed-app list and exfiltrates it via a network request to a command-and-control server or an attacker-controlled endpoint.

Step 4 — Post-Exploitation Impact:

With knowledge of installed applications, the attacker's app can:

• Profile the target device: Determine which sensitive apps (banking, secure messaging, VPN, MDM) are installed, informing further targeted attacks.
• Chain with other vulnerabilities: The enumerated app list can be used to identify specific app versions to exploit via separate known CVEs in those apps.
• Feed phishing campaigns: Information about installed apps enables highly targeted phishing lures (e.g., "Click to update your banking app" when a banking app is detected).
• Bypass security controls: Knowing whether a device has EDR/mobile threat defense or enterprise MDM agents installed helps malware evade detection.

The confidentiality impact is rated LOW in the CVSS vector, meaning the disclosed information is limited but present.

Impact Assessment

CVSS Analysis:

CVE-2026-43657 has a CVSS v3.1 base score of 3.3 with the vector:

• Attack Vector (AV): L — Local only; attacker must have the ability to run code on the device.
• Attack Complexity (AC): L — No special conditions; the exploitation is straightforward.
• Privileges Required (PR): L — A standard third-party app sandbox; no elevated privileges.
• User Interaction (UI): N — None required; the attack is silent.
• Scope (S): U — Unchanged; the security impact is confined to the vulnerable component.
• Confidentiality (C): L — Low confidentiality impact (app list disclosure).
• Integrity (I): N — No integrity impact.
• Availability (A): N — No availability impact.

This is a LOW-severity vulnerability. However, CVSS scores alone do not fully capture the real-world risk for mobile device fleets.

Business Impact:

• Privacy compliance concerns: For enterprises with stringent data-protection requirements (e.g., financial services, healthcare, legal), the ability of a malicious app to enumerate installed apps may violate internal security policies even if it does not trigger regulatory breach thresholds.
• Attack-chain enabler: While the vulnerability itself is low severity, it enables reconnaissance that reduces the effort for follow-on attacks. An attacker who knows exactly which apps are installed can craft precise, version-specific exploits or phishing campaigns.
• BYOD environments: In bring-your-own-device (BYOD) configurations, employees' personal iOS devices that handle corporate email or data are affected. A malicious consumer app installed on the same device can silently enumerate corporate apps, revealing the OS version, MDM presence, and security posture.

Blast Radius:

• Affected systems: All devices running iOS/iPadOS versions prior to 26.5, including iPhone and iPad models eligible for the update.
• Exploitability: Requires the user to install a malicious app. App Store review may or may not catch the malicious behavior depending on how the API is invoked and obfuscated. For enterprise-distributed apps, the review gap is wider.
• EPSS Score: 0.00090 (0.5% percentile) — the probability of real-world exploitation in the next 30 days is extremely low. No known exploits circulate, and the vulnerability is not listed in CISA KEV.

Overall Risk Assessment: LOW real-world risk, driven primarily by the absence of exploit code, the low severity score, and the low EPSS value. Enterprise mitigation priority should be low, but routine patching is recommended.

Detection Guidance

Due to the absence of a public PoC, exploit code, or detailed technical analysis, the detection rules below focus on the generic signatures of local malware enumeration behavior on iOS and the associated network exfiltration patterns. These rules are best-effort heuristics and should be tuned to the environment.

Sigma Rule

title: Suspicious Installed App Enumeration on iOS
id: 50e8a6c4-9b8d-4a17-8b3f-3c1f54a2d7b6
status: experimental
description: Detects attempts by a mobile app to enumerate installed applications, which can indicate exploitation of CVE-2026-43657 or similar permission bypass issues.
author: ValtersIT Threat Intelligence
date: 2026-06-01
logsource:
    category: application
    product: mobile
detection:
    selection:
        event_type: app_install_query
        api_call: 
            - "installedApps"
            - "applicationInfo"
        privilege_context: "user-level"
    condition: selection
level: medium
falsepositives:
    - Legitimate launcher apps that display installed applications to the user
    - MDM agents that enumerate corporate apps for compliance checks
    - App stores checking for updates
    - System utilities that show app storage usage
tags:
    - attack.t1068
    - attack.collection
    - cve.2026-43657

YARA Rule

rule CVE_2026_43657_App_Enumeration_Indicator
{
    meta:
        author = "ValtersIT Threat Intelligence"
        date = "2026-06-01"
        description = "Detects strings and patterns commonly found in iOS malware that enumerates installed applications via permission bypass."
        cve = "CVE-2026-43657"
        severity = "low"
    strings:
        $s1 = "installedApplication" ascii wide nocase
        $s2 = "appList" ascii wide nocase
        $s3 = "bundleIdentifier" ascii wide nocase
        $s4 = "privateApplication" ascii wide nocase
        $s5 = "enumerateApps" ascii wide nocase
        $s6 = "installedAppsList" ascii wide nocase
        $s7 = "appInfoDump" ascii wide nocase
        $s8 = "applicationList" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and 4 of ($s*) 
        or filesize < 5MB and 3 of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-43657 - Installed App List Exfiltration Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/collect"; http_uri; nocase; content:"installed"; http_client_body; nocase; content:"app"; http_client_body; nocase; within:100; content:"bundle"; http_client_body; nocase; within:400; sid:202643657; rev:1; metadata:created_at 2026_06_01, updated_at 2026_06_01, cve 2026-43657, confidence low;)

Elastic Detection

// Detect iOS app processes that make multiple calls to private APIs
// related to installed application enumeration within a short window.
sequence by process.entity_id with maxspan=30s
  [process where event.action == "start" and process.name : "app" and
   event.outcome == "success"]
  [api where event.action == "call" and
   process.name : "app" and
   api.name in ("installedApps", "privateAppInfo", "appListQuery")]

Splunk SPL Query

index=mobile sourcetype=ios_logs
| where like(_raw, "%installedApps%") OR like(_raw, "%bundleIdentifier%") OR like(_raw, "%appList%")
| eval vuln_cve="CVE-2026-43657"
| stats count by app_name, device_id, src_ip, _time
| where count > 10
| table _time, app_name, device_id, src_ip, count
| sort - count

Wazuh OSSEC Rule

<group name="ios,malware,cve-2026-43657,">
    <rule id="100257" level="7">
        <decoded_as>json</decoded_as>
        <field name="event_type">^app_install_query$</field>
        <field name="api_call">installedApps|applicationInfo|privateAppInfo</field>
        <description>CVE-2026-43657 - Malicious iOS app attempted to enumerate installed applications</description>
        <group>attack_collection,attack_t1068,</group>
        <mitre>
            <id>T1068</id>
        </mitre>
        <info type="cve">CVE-2026-43657</info>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment: 2/4 (CLAIMED) — Only NVD lists the patch as available in iOS 26.5 and iPadOS 26.5. This has not been independently verified via Apple's official security advisory page. While the NVD claim is generally reliable, security teams should confirm the fix via Apple's release notes before assuming full coverage.

1. Immediate Mitigations (No Patch Installed):

• If iOS 26.5 / iPadOS 26.5 is not yet deployed, restrict the installation of nonessential or untrusted applications on corporate-managed devices. Use Apple Business Manager (ABM) and Mobile Device Management (MDM) to enforce application allowlisting.
• Enable iOS's built-in protections: Device Management supports the allowAppInstallation and allowAppRemoval restrictions; configure MDM to disallow installation of apps from outside your approved catalog.
• Implement app attestation and integrity checks via MDM to ensure only signed and approved applications run on managed devices.
• Educate users on phishing attempts that persuade them to install apps outside the MDM catalog.

2. Patch / Upgrade Steps:

• Update all managed iPhones and iPads to iOS 26.5 or iPadOS 26.5 (or later) as soon as feasible:
  • For supervised devices: Push the update via MDM using the DeviceRestrictions command or by announcing the update through the self-service portal.
  • For BYOD devices: Issue a policy requiring all devices accessing corporate resources to update to iOS/iPadOS 26.5 within a defined compliance window. Enforce the policy via conditional access (e.g., Microsoft Intune or Jamf conditional access, or a zero-trust compliance policy).
• After patching, verify device OS version via MDM inventory to confirm each device meets the 26.5 baseline.
• There is no vendor-provided workaround for unpatched devices; the vulnerability is only fixable via the OS update.

3. Long-Term Hardening:

• Subscribe to Apple Security Releases (https://support.apple.com/en-us/100100) and NVD for notification of future iOS security updates. Incorporate this feed into your vulnerability management pipeline with a patching SLA appropriate to the severity.
• Establish a formal mobile device patch policy that treats OS updates as critical infrastructure changes; schedule monthly/quarterly rollouts.
• For high-security environments, consider using iOS's "Managed Open In" and "Data Leak Prevention" features to reduce the potential impact of information disclosure from a malicious app.
• Perform periodic security reviews of all third-party SDKs used in your organization's own iOS applications; supply-chain compromise via SDKs is a primary vector for injecting malicious behaviors like app enumeration.
• Monitor EPSS and CISA KEV feeds for changes in the exploitation status of CVE-2026-43657; reassess risk and prioritize if an exploit surfaces or if the CVE is added to KEV or exploited-in-the-wild reports.

References

1. NVD Entry for CVE-2026-43657 — https://nvd.nist.gov/vuln/detail/CVE-2026-43657 (Source of the description, CVSS score, and patch claim)
2. Apple Security Releases (general advisory hub) — https://support.apple.com/en-us/100100 (Verify iOS 26.5 / iPadOS 26.5 release notes and security content)
3. Apple iOS 26.5 Release Notes — https://developer.apple.com/news/releases/ (Confirm fixed version and features)
4. ATT&CK Technique T1068 — Exploitation for Privilege Escalation — https://attack.mitre.org/techniques/T1068/ (Relevant classification for the permission bypass mechanism at the class level)
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-43657 is NOT listed; monitor for future changes)

Known Threat Actor Campaigns / Exploit-in-the-Wild Evidence: None identified as of the report date. No public exploit code exists, no Nuclei template is available, and the CVE is not present in the CISA KEV catalog. The EPSS percentile (0.5%) indicates a very low likelihood of near-term exploitation.