A defect in entitlement enforcement allows an application to bypass user‑defined privacy preferences, potentially exposing personal data that the user has restricted. The flaw is a failure to verify required entitlements before granting access to protected resources, which aligns with CWE‑288. An attacker could obtain data such as contacts or location information without the user’s permission, resulting in a confidentiality breach.

Apple iOS and iPadOS devices running versions prior to 18.4 and Apple visionOS devices prior to 2.4 are affected. The security issue applies to all builds of iOS, iPadOS, and visionOS that lack the latest entitlement checks fixed in the listed releases.

The vulnerability scores a high CVSS of 7.6, indicating that it is significant if exploited. The EPSS score of less than 1% suggests exploitation likelihood is currently low, but the high severity warrants attention. It is not in the CISA KEV catalog, meaning known exploit code is not publicly documented. The likely attack vector involves a malicious third‑party app installed on the device, which could use the missing entitlement check to read data the user has opted out of. Once the app runs on the device, the restriction can be bypassed without additional user interaction.