A logic issue in Apple iOS and iPadOS permits an application to gather information about the current camera view before it has been granted camera access. The flaw constitutes an information‑disclosure vulnerability classified as CWE‑284. Because the app can learn camera‑view details without permission, an attacker could potentially use this data to infer user activities or context. The vulnerability does not provide a direct path to remote code execution, but it lowers user privacy guarantees.

The affected firmware runs on Apple iOS and iPadOS devices. The flaw exists in all versions prior to iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, and iPadOS 26.1, as indicated by Apple’s support documentation. Updating the operating system to any of those fixed releases eliminates the logic bug. Devices running later releases are considered not affected by this specific issue.

The CVSS score of 7.5 marks it as a high‑severity vulnerability, and an EPSS score of less than 1% suggests the probability of exploitation is currently very low. The issue is not listed in the CISA KEV catalog. Attackers would need to convince or trick a user into installing a malicious app that exploits this logic path; it is likely a local or device‑end user attack vector. Because the vulnerability centers on early disclosure of camera view data, the impact is limited to privacy concerns, and no requirement for elevated privileges or network access is described.