An authentication flaw in iOS and iPadOS was corrected by improving state management. Devices that had not yet applied the 18.3 update could allow an attacker who has physical access to a device in an unlocked state to view or retrieve content from the Photos app even when that app is locked. The flaw does not enable remote code execution or system compromise beyond the limited exposure of personal images and may be immediately exploitable by anyone with the device in hand.

Apple iOS and Apple iPadOS versions prior to iOS 18.3 and iPadOS 18.3 are affected.

The CVSS score of 3.3 denotes a low‑severity vulnerability, and the EPSS score of less than 1 percent indicates that the probability of exploitation is very small. Because the attack requires the device to be physically accessible and already unlocked, the risk is limited to situations where the user leaves the device unattended. The vulnerability is not listed in the CISA KEV catalog and no widespread exploitation has been reported.