A configuration issue allows an attacker to use Siri while a device is locked to enable Auto‑Answer Calls, which can lead to unintended voice‑call activation and potential privacy or service abuse. The flaw resides in how options are presented on a locked device, thereby exposing a privileged function without appropriate access controls. The vulnerability falls under CWE‑284, indicating a weakness in access control that permits unauthorized functional use.

Apple iOS and iPadOS devices, including all iPhone and iPad models using the operating systems before the 18.4 release. The problem is fixed in iOS 18.4 and iPadOS 18.4; devices running earlier versions remain vulnerable.

The CVSS score of 9.1 classifies this as a critical flaw, yet the EPSS score is less than 1 %, suggesting a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to invoke Siri while the device is locked, which typically requires local access or a compromised voice‑assistant session. No remote exploitation path is described in the available data, so the threat is primarily limited to scenarios where an attacker can trigger Siri on a locked device.