CVE-2026-20638
📋 TL;DR
This vulnerability allows identifying information to leak to Live Caller ID app extensions even when those extensions are disabled. It affects iOS and iPadOS users who have disabled Live Caller ID extensions but remain on vulnerable versions.
💻 Affected Systems
- iOS
- iPadOS
📦 What is this software?
Ipados by Apple
⚠️ Risk & Real-World Impact
Worst Case
Sensitive caller identification data could be exposed to third-party extensions without user consent, potentially revealing private contact information or call patterns.
Likely Case
Limited information leakage to extensions that the user has already installed but disabled, with potential privacy implications depending on extension permissions.
If Mitigated
With extensions disabled and proper patching, no information leakage occurs.
🎯 Exploit Status
Requires malicious or compromised app extensions to be present on device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iOS 26.3, iPadOS 26.3
Vendor Advisory: https://support.apple.com/en-us/126346
Restart Required: Yes
Instructions:
1. Go to Settings > General > Software Update. 2. Download and install iOS 26.3 or iPadOS 26.3. 3. Restart device after installation completes.
🔧 Temporary Workarounds
Disable Live Caller ID Extensions
iOS/iPadOSRemove or disable all Live Caller ID app extensions to prevent potential information leakage.
Settings > Phone > Live Caller ID > Toggle off all extensions
🧯 If You Can't Patch
- Remove all third-party Live Caller ID extensions from device
- Disable Live Caller ID functionality entirely in Phone settings
🔍 How to Verify
Check if Vulnerable:
Check Settings > General > About > Version. If version is earlier than 26.3, device is vulnerable.Check Version:
Settings > General > About > VersionVerify Fix Applied:
Confirm device shows iOS 26.3 or iPadOS 26.3 in Settings > General > About > Version.📡 Detection & Monitoring
Log Indicators:
- Unusual extension activity in system logs
- Privacy-related access violations
Network Indicators:
- None - local vulnerability only
SIEM Query:
Not applicable for local device vulnerability