The vulnerability arises from an improper authorization check in iOS and iPadOS that allows an attacker who has a USB‑C connection to an unlocked device to programmatically access photos. This flaw is classified as CWE‑284, illustrating a weakness in access control that compromises confidentiality. While it does not provide broader system compromise, the attacker could retrieve any photo stored locally on the device.

Apple iOS and iPadOS devices running versions prior to 18.4 are affected. The fix is provided in iOS 18.4 and iPadOS 18.4, so any device not updated to these releases remains at risk.

The CVSS score is 2.4, indicating low severity. The EPSS score is below 1%, reflecting a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation is limited to situations where an attacker has physical access to the device via USB‑C and the device is unlocked. Under these constraints, the risk is moderate but constrained to physical possession and unlocking the device.