An application can masquerade as system alerts, potentially misleading users by displaying forged notifications. The flaw stems from an improper entitlement check, which is a form of weak authentication (CWE‑290). When exploited, an attacker might cause a denial‑of‑service by disrupting or hijacking notification delivery mechanisms.

The vulnerability affects devices running Apple iOS and iPadOS. Systems prior to iOS 18.3 and iPadOS 18.3 (or iPadOS 17.7.3 for iPadOS‑only devices) are susceptible, whereas updated releases contain the fix.

The CVSS v3.1 score of 5.5 indicates moderate impact, and the EPSS score of less than 1% suggests low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Given that the flaw requires an application with restricted entitlements and operates within the device’s local environment, the most likely attack vector is a local, user‑initiated installation of a malicious app.