The flaw allows an attacker with arbitrary memory read and write capabilities to bypass Apple’s pointer authentication mechanism. By subverting these hardware‑based integrity checks, the attacker can overwrite or inject executable code and execute it with elevated privileges, effectively compromising the integrity and confidentiality of the device and allowing remote code execution.

The vulnerability affects Apple’s iOS, iPadOS, macOS Sequoia, tvOS, and visionOS. It is mitigated in the latest releases: iOS 18.4.1, iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, and visionOS 2.4.1. Devices running earlier versions are still vulnerable.

With a CVSS score of 9.8 and an EPSS of 3%, the risk is critical and the likelihood of exploitation is non‑negligible. Apple is aware of a report that this issue may have been exploited in a sophisticated attack against targeted individuals on iOS, and the flaw is listed in the CISA KEV catalog. The requirement for arbitrary read/write suggests a precursor weakness, but once bypassed the attacker can achieve full code execution, elevating the threat to a high level of severity.