This privacy vulnerability allows sensitive call history from apps that have been deleted to appear in Spotlight search results, potentially exposing personal communication records. The flaw stems from the incomplete removal of call logs when an app is deleted, leading to inadvertent disclosure of private data (CWE‑200). While the vulnerability does not grant traditional unauthorized access or code execution, it does compromise confidentiality by exposing personal information that should have been fully removed.

Apple iOS and iPadOS devices running versions prior to iOS 18.5 or iPadOS 18.5 are affected. The issue is fixed in iOS 18.5 and iPadOS 18.5. Devices with earlier releases remain vulnerable.

The CVSS score of 7.1 indicates a high severity vulnerability, though the EPSS score of less than 1% suggests very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers or even ordinary users can trigger the issue simply by performing a Spotlight search on the device; no special privileges or network access are required. The likely attack vector is local device use, where Spotlight queries the undisposed storage and surfaces the residual call history.