A logic flaw in Apple’s state management allows a malicious application running on a device to attempt passcode entries while the device is locked, incrementally increasing the wait time after four failed attempts. The result is that legitimate users experience progressively longer delays before they can attempt a new passcode entry, effectively denying timely access to the device. The weakness is categorized as CWE-287, an authentication failure condition.

Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The flaw is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, and watchOS 11.4. Devices running earlier versions remain susceptible.

The CVSS score of 6.4 indicates moderate severity. EPSS scores below 1% suggest a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring a malicious app with the ability to trigger passcode entry attempts on a locked device. No public exploits have been documented, and remediation relies on applying the vendor’s software updates.