Technical impact
Apple iOS and iPadOS devices have a flaw in state management that can cause the lock screen to become permanently inoperative. When the defect is triggered, the device may persistently fail to lock, effectively removing the ability to secure the device after a fault occurs. The vulnerability is categorized as CWE‑284 due to improper access control in the lock‑screen logic.
Affected Systems
Vulnerable firmware includes all iOS and iPadOS versions released prior to iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, and iPadOS 26.1. Devices running these older releases may experience a lock‑screen failure; the state‑management fixes are included in the newer releases listed above.
Risk and Exploitability
The CVSS score of 7.5 indicates a high‑severity denial‑of‑service scenario, while the EPSS score of < 1 % suggests that exploitation is currently unlikely with publicly available tools. The vulnerability is not listed in the CISA KEV catalog. The attack vector is not specified in the CVE entry; based on the description this issue may require a local fault that triggers the state‑management failure, but the precise exploit path is not documented.
