A permissions issue in Apple operating systems allows applications to gather data that can identify and track individual users. The vulnerability is an instance of Incorrect Permission Assignment, where code runs with more privileges than intended, enabling an app to fingerprint a user. The exploitation would compromise privacy, allowing the attacker to identify a user across services or sessions, though it does not grant direct system compromise or data theft beyond that scope.

Affected Apple products include iOS and iPadOS versions 18.7.2 and 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1. Upgrading any of these systems to the listed patch versions removes the vulnerability.

The CVSS score of 5.3 classifies the vulnerability as moderate, while the EPSS score of less than 1 percent indicates a very low likelihood of exploitation. The issue is not listed in CISA’s KEV catalog. The most probable attack vector is local: any user‑installed app that obtains the necessary system permissions could perform fingerprinting. No network‑based remote exploitation path is described.