A coding oversight in Apple’s privacy indicator logic caused the visual alerts for active microphone or camera usage to be displayed incorrectly. As a result, users could be unaware that their device is capturing audio or video, which could be exploited for covert data collection. The weakness is a security feature failure that undermines user trust and consent mechanisms.

Apple’s iOS and iPadOS operating systems are affected. The issue exists in all releases prior to iOS 18.6 and iPadOS 18.6, as well as iPadOS 17.7.9 and earlier. Users running older firmware versions should be aware of this limitation.

The CVSS score of 4 reflects a low severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no remote exploitation vectors are documented. The attack vector is inferred to be local—an attacker would need to trigger a scenario where the user’s privacy indicator is expected to reflect activity, but it fails to do so, allowing covert collection. Although the impact is primarily on privacy and user awareness, it does not compromise system integrity or allow further exploitation.