An authentication flaw in watchOS state management can allow an attacker with physical possession of a locked Apple Watch to read Live Voicemail. The vulnerability permits exploitation without compromising the passcode, violating the user's privacy and confidentiality by exposing voicemail content.

Apple WatchOS devices running versions prior to 26.1 are impacted. The fix was applied in watchOS 26.1, so any watchOS version earlier than 26.1 remains vulnerable.

The CVSS score of 4.6 indicates moderate severity, and the EPSS score of <1% suggests a very low likelihood of exploitation. Because the issue requires physical access to a locked device, its practical risk is limited to situations where an adversary can obtain the device. The vulnerability is not currently listed in the CISA KEV catalog.