An Apple iOS and iPadOS vulnerability allows a person with physical access to a device to retrieve photos from the lock screen. The flaw is tied to improper authorization controls, enabling media privacy to be exposed without authentication. Because the issue is limited to accessing local media files and does not promote code execution or system compromise, the overall impact is a privacy breach rather than a full compromise of the device.

Vendors impacted are Apple for iOS and iPadOS. The vulnerability is fixed in iOS 18.4 and iPadOS 18.4; affected releases are those older than 18.4, though specific version ranges are not enumerated in the advisory.

The CVSS score of 2.4 indicates low severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack requires the attacker to be in physical proximity to the device and to have access to the lock screen, so the APT risk is limited. There is no known public exploit, and the attack vector is inferred to be local physical access based on the description.