A logic flaw in iOS and iPadOS allows photos stored in the Hidden Photos Album to be accessed without authentication, exposing personal images to anyone who has local device access. This unauthorized disclosure of confidential visual data compromises privacy.

Apple iOS and iPadOS devices running any OS version prior to iOS 18.3 or iPadOS 18.3, which contain the unpatched logic issue in the Hidden Photos handling.

The CVSS score of 3.3 indicates moderate severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the most likely attack vector is local access to the device, requiring the attacker to have physical possession or already compromise the device through another vulnerability.