A permissions flaw allows an application to read a persistent device identifier previously protected by stricter device‑level restrictions. The vulnerability does not enable arbitrary code execution or privilege escalation but exposes a unique device identifier that could be used for tracking, profiling, or linking user activity across services. The weakness is a classic information disclosure flaw identified as CWE‑200.

The flaw affects Apple’s mobile operating systems, specifically iOS and iPadOS. Versions prior to iOS 18.4, iPadOS 18.4, and the older iPadOS 17.7.9 are vulnerable. Devices running the affected releases must be updated to the stated patched versions to eliminate the issue.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests that real‑world exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. It can be exploited by any application on the device that gains authorization to read device identifiers, meaning the threat vector is local, arising from any installed app. Because the flaw does not require additional conditions such as network access or user interaction beyond normal permission usage, it is relatively easy for an attacker who controls an app to read the identifier.