A correctness issue involving incorrect privilege assignment allows an attacker to elevate privileges, potentially giving them broader access to system resources or the ability to execute privileged code. The vulnerability is classified as CWE-269. The impact is that a user with the exploit could gain higher level permissions than intended, affecting the confidentiality, integrity, and availability of the device. It does not appear to be a denial‑of‑service flaw but rather a direct compromise of the operating system’s privilege model.

Apple iOS and iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The issue was addressed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, and watchOS 11.5.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests exploitation is unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. Based on the description it is inferred that the attack requires the ability to run code on the device, thus the attack vector is most likely local or requires a user to execute malicious code. If exploited, the attacker could perform privileged actions that may lead to system compromise or unauthorized data access.