Apple identified a permissions misconfiguration that permits a malicious application to elevate its privileges to the operating system’s root level. The flaw stems from insufficient permission checks, which is reflected by CWE‑276. When executed, the compromised app can access any surface of the device, enabling it to read, modify, or delete protected data, install malicious software, or compromise connected devices. The impact is a full compromise of device integrity and confidentiality for the affected user or organization.

The vulnerability is present across Apple’s mobile and desktop platforms. Specifically, it affects iOS and iPadOS versions prior to 18.3, macOS Sequoia prior to 15.3, tvOS prior to 18.3, and watchOS prior to 11.3. Devices running these operating systems are at risk until the listed release is applied.

The flaw carries a CVSS score of 7.8, indicating high severity, but its EPSS score is below 1%, suggesting the attack window is currently narrow. The vulnerability is not listed in CISA’s KEV catalog, further implying no widespread, active exploitation is known. Attackers would need to trick users into installing a malicious application or exploit the flaw via a local context; no remote exploitation vector is documented. Given the potential for total system takeover and the low probability of exploitation, the risk remains substantial for any device running an affected OS version.