The vulnerability is a logic flaw that allows an attacker with physical access to a locked device to view sensitive user information. The flaw is classified as CWE-200, indicating an information disclosure weakness. As a result, confidentiality of user data can be compromised if the device is accessed by a non‑authorized individual while it remains in a locked state.

Apple's iOS and iPadOS operating systems are affected. The flaw is present in all builds prior to iOS 26.1 and iPadOS 26.1. Devices running any earlier release inherit this weakness, while the cited Apple versions contain the remediation.

The CVSS score of 4.6 denotes moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation. The attack vector is inferred to be local physical access to a locked device; remote exploitation is not supported by the description.