CVE-2026-46486

Description

Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing

Description (MITRE) cveawg.mitre.org

Pulled from cveawg.mitre.org/api/cve/CVE-2026-46486 on 2026-07-28. Shown when MITRE's text differs from the cvelistV5 mirror.

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise. Prior to version 2026.5.12, there is a path traversal vulnerability via unsanitized File identifiers in iOS Backup processing. This issue has been patched in version 2026.5.12.

Overview

State

—

Assigner (CNA)

—

CVSS severity

high

CVSS score

7.5 / 10

CVSS vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Effective score

7.5 / 10 HIGH source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-46486

Linked Threat

CVE-2026-46486 — CVE-2026-46486

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-35186

Assigner

GitHub_M

Published

Jun 8, 2026, 6:30:53 PM

Updated

Jun 8, 2026, 7:51:37 PM

EUVD base score (CVSS 4.0)

5.3 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

EUVD-reported EPSS

0.3800

Vendors

mvt-project

Products

mvt (< 2026.5.12)

Aliases

GHSA-5h3g-px23-w6vw

ENISA description: MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise. Prior to version 2026.5.12, there is a path traversal vulnerability via unsanitized File identifiers in iOS Backup processing. This issue has been patched in version 2026.5.12.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (4)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://github.com/mvt-project/mvt/releases/tag/v2026.5.12 tenable:github.com
• https://github.com/mvt-project/mvt/security/advisories/GHSA-5h3g-px23-w6vw tenable:github.com
• https://nvd.nist.gov/vuln/detail/CVE-2026-46486 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-46486 tenable:www.cve.org

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Oracle Critical Patch Update, April 2026 Security Update Review
  web:blog.qualys.com

  Oracle released its second quarterly edition of this year's Critical Patch Update. The update received patches for 481 security vulnerabilities.

  2026-05-26 03:00 UTC
• Wireshark 4.6.6 Released With Fix for Dissector Crash via Malformed ...
  web:cybersecuritynews.com

  The Wireshark Foundation has released Wireshark 4.6.6, addressing a critical security vulnerability in the ROHC (Robust Header Compression) protocol dissector that could allow an attacker to crash the application by injecting a specially crafted, malformed packet.

  2026-05-26 03:00 UTC
• Security Advisories and Bulletins | Microsoft Learn
  web:learn.microsoft.com

  Learning path Learn how Microsoft supports secure software development as part of a cybersecurity solution - Training Secure software development means integrating security into each phase of your development lifecycle, from requirements analysis to maintenance. Microsoft provides many services that can help you develop more secure code and deploy a more secure application in the cloud. This ...

  2026-05-26 03:00 UTC
• Nvd - Cve-2026-8486
  web:nvd.nist.gov

  An official website of the United States government Here's how you know

  2026-05-26 03:00 UTC
• Critical Patches Issued for Microsoft Products, May 12, 2026
  web:www.cisecurity.org

  <p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...

  2026-05-26 03:00 UTC
• Critical Patch Updates, Critical Security Patch Updates ... - Oracle
  web:www.oracle.com

  Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.

  2026-05-26 03:00 UTC
• Oracle Patches 450 Vulnerabilities With April 2026 CPU
  web:www.securityweek.com

  Oracle on Tuesday announced the release of 481 new security patches as part of its April 2026 Critical Patch Update (CPU). Across the 28 product families that received security updates, more than 300 patches address vulnerabilities that are remotely exploitable without authentication.

  2026-05-26 03:00 UTC
• Oracle April 2026 Critical Patch Update 241 CVEs | Tenable®
  web:www.tenable.com

  Oracle addresses 241 CVEs in its April Critical Patch Update, the second quarterly update of 2026 with 481 patches, including 34 critical updates.

  2026-05-26 03:00 UTC
• Windows 11 April 2026 Update tested: What's new, improved and fixed
  web:www.windowslatest.com

  Windows 11 April 2026 update adds Narrator Copilot support, faster Settings, File Explorer fixes, and key security improvements.

  2026-05-26 03:00 UTC
• Patch Tuesday May 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-05-26 03:00 UTC

Only Available for Registered Users. Sign in to view.