An issue with state management in Apple iOS and iPadOS allows an attacker who is in a privileged network position to intercept network traffic sent by the device. The vulnerability is classified as CWE-300, Information Exposure. The potential impact is that sensitive data can be captured during transmission, compromising confidentiality of communications while on the same network.

Apple iOS and iPadOS devices, any versions prior to 18.5, are affected. The fix is released in iOS 18.5 and iPadOS 18.5, so all earlier releases need updating.

The CVSS score of 8.1 indicates a high severity, but the EPSS score of <1% suggests a low probability of exploitation in the wild. It is not listed in CISA’s KEV catalog, reducing the likelihood of widespread use. The likely attack vector is a network‑based attack from a position with privileged network access, as the exploit requires the ability to observe traffic to the device.