This vulnerability results from improper permission checking that enables an application to access the local network without proper authorization. The flaw is classified as CWE‑281, indicating an authorization weakness. An attacker could use a malicious or misconfigured app to discover, communicate with, or manipulate devices on a local network, potentially exfiltrating data or disrupting services for that network.

Affected Apple products include Safari, iOS, iPadOS, macOS, and visionOS. The remedy is available in Safari 18.4, iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, and visionOS 2.4.

The CVSS score of 7.8 places this issue in the high‑severity range, while the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a malicious or intentionally misbehaving application that bypasses standard local‑network permission prompts, allowing it to probe or communicate with devices on the user’s local network.