The vulnerability allows an application running on Apple iOS or iPadOS to capture user keystrokes without the user’s explicit permission. By exploiting this flaw, a malicious or untrusted app could silently log typed data, potentially compromising sensitive personal information such as passwords, credit card numbers, or private messages. This is a privacy breach affecting confidentiality and may lead to identity theft or other malicious exploitation. It is classified as a data disclosure and authorization weakness (CWE‑200 and CWE‑284).

Apple iOS and iPadOS devices are affected. The flaw exists in all versions prior to iOS 18.7.2, iOS 26.1, iPadOS 18.7.2, and iPadOS 26.1. Devices running these earlier releases can be targeted until they receive the correction.

The CVSS score of 5.4 indicates a moderate impact. The EPSS score is below 1 %, suggesting that exploitation is currently unlikely. Apple has not classified this vulnerability as a known exploited vulnerability in CISA KEV. The likely attack vector is local, requiring the installation or execution of a malicious app on the device. Once the app is active, it could monitor keyboard input across other apps, bypassing the standard permission model. Because of the low EPSS and the need for local deployment, the overall risk is moderate, but remediation through updating the operating system is recommended.