The flaw allows an attacker with arbitrary memory read and write capabilities to bypass Apple’s pointer authentication mechanism. This is a CWE‑1220 Pointer Authentication Bypass. The CVE description does not explicitly state the consequences, so it is inferred that the attacker could potentially compromise the integrity and confidentiality of the device.

The vulnerability affects Apple’s iOS, iPadOS, macOS Sequoia, tvOS, and visionOS. It is mitigated in the latest releases: iOS 18.4.1, iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, and visionOS 2.4.1. Devices running earlier versions are still vulnerable.

With a CVSS score of 9.8 and an EPSS of 13%, the risk is critical and the likelihood of exploitation is moderate. The flaw is listed in the CISA KEV catalog. The CVE notes a report of potential exploitation in a sophisticated attack against specific targeted individuals on iOS, but no confirmed widespread exploitation is indicated. The requirement for arbitrary read/write indicates that a precursor vulnerability is needed for the bypass.