The vulnerability arises from inadequate checks within Apple’s operating system, allowing applications to determine a user’s current location without going through the standard permission workflow. This flaw can lead to privacy violations by exposing sensitive location information. The weakness is characterized as CWE‑200, which describes information disclosure vulnerabilities.

Apple’s iPadOS and macOS products are affected. The defect is fixed in iPadOS 17.7.4 and in macOS releases Sequoia 15.3, Sonoma 14.7.3, and Ventura 13.7.3. Users running earlier versions of these operating systems remain vulnerable.

The CVSS score of 9.8 underscores a high severity issue. The EPSS value of less than 1% suggests that exploitation is currently low probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation would typically involve a malicious app installed on the device; such an app could bypass normal location permission checks and read the user’s precise position. Because the weakness is client‑side, the attack surface is limited to applications already present on the device.