An additional entitlement check was required to prevent apps from collecting device information that could identify a user. Without the check, an application may be able to fingerprint the user by retrieving identifiers or other device attributes, leading to a privacy breach. The weakness is classified as CWE-200, exposing sensitive information.

Apple releases for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are affected. The firmware fix is available in versions 26 of each platform, but the specific earlier releases that remain vulnerable are not enumerated in the advisory.

The CVSS score of 8.1 indicates high severity. EPSS is below 1 %, suggesting low exploitation probability, and the vulnerability is not in the CISA KEV catalogue. An attacker would need to install or exploit a malicious app that can read device identifiers. Because the flaw hinges on missing entitlement validation, the attack is likely local, requiring the app to run on the device, but it can be leveraged by any application that has appropriate installation privileges.