CVE-2024-40826

Vulnerability

A privacy issue exists in the handling of files during print preview. When a user invokes print preview, an unencrypted document may be written to a temporary file. This affects versions prior to iOS 18, iPadOS 18, and macOS Sequoia 15. The issue is addressed with improved checks in the fixed releases [1][2].

Exploitation

An attacker would need access to the temporary file location, which could be achieved through a malicious app with file system access or by being on the same system. The sequence involves the user printing a document with print preview, causing the unencrypted content to be written to a temporary file; an app with read access to that temporary directory can then retrieve the document [1][2].

Impact

Successful exploitation allows an app to leak sensitive user information from the unencrypted temporary file. The impact is information disclosure, potentially exposing the contents of the printed document [1][2].

Mitigation

The vulnerability is fixed in iOS 18, iPadOS 18, and macOS Sequoia 15, released on September 16, 2024. Users should update to these versions. No workarounds are documented, and the issue is not listed on the CISA Known Exploited Vulnerabilities catalog [1][2].