A vulnerability in Apple iOS and iPadOS allows a locally installed application to capture keystrokes without obtaining explicit user permission. The weakness is classified as CWE‑200 Sensitive Data Exposure and can let an application read input from any active text field, thereby compromising the confidentiality of user data. The CVE description does not specify particular types of data that may be exfiltrated, but the potential exists for any information typed by the user.

The flaw affects devices running Apple iOS or iPadOS versions older than iOS 18.7, iOS 26, iPadOS 18.7, or iPadOS 26. Users should verify that their operating system is at least version 18.7 for Apple‑brand major releases or the equivalent iOS 26 for newer releases, as these releases contain the fix.

With a CVSS score of 9.8 the vulnerability is considered critical. The EPSS score is reported as less than 1 %, indicating that exploitation is predicted to be rare at this time, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is the local installation of a malicious application, possibly through the App Store or other distribution channels, after which the application can unobtrusively harvest typed data. An attacker would need only local installation privileges; no remote code execution or elevated privileges are required for exploitation.