The vulnerability allows an attacker to view photos stored in the Hidden Photos Album without authentication. This bypasses the intended privacy controls and permits unauthorized access to sensitive personal media, directly compromising confidentiality. It is rooted in an inadequate verification of permissions, reflected by its CWE‑306 classification.

Apple devices running iOS or iPadOS prior to version 26.2, macOS Tahoe prior to 26.2, and visionOS prior to 26.2 are affected. The fix is included in version 26.2 of each operating system; any versions before that remain vulnerable.

With a CVSS score of 9.8, the flaw is considered critical. The EPSS score of less than 1% indicates that while exploitation is unlikely, it remains possible, especially for users who physically or locally access the device. The vulnerability is not listed in the U.S. CISA KEV catalog, but its high severity warrants prompt remediation. Attackers who can access the device or trick a user into navigating to the Hidden Photos Album could therefore gain unauthorized visibility of personal images.