A logic flaw in Apple operating systems was identified, allowing an application to bypass standard privilege checks and run with elevated system permissions. The vulnerability arises from insufficient validation during certain user-interaction flows, which can be exploited by a crafted app or malicious payload. If successful, the attacker gains the ability to execute code with full system authority, potentially compromising data confidentiality, integrity, and overall device security.

Apple iOS and iPadOS versions prior to 18.7.3, macOS Sequoia versions earlier than 15.7.3, macOS Sonoma earlier than 14.8.3, and macOS Tahoe earlier than 26.2 are affected. All devices running these operating systems could run the vulnerable code if an app attempts to elevate privileges.

The CVSS score of 7.8 indicates a high severity of privilege escalation. The EPSS score is below 1%, suggesting that the probability of exploitation in the general population is low, and the vulnerability is not yet listed in CISA’s KEV catalog. The attack vector is inferred to be local or through a malicious app installed on the device, requiring privileged use of the operating system’s application installation pathways. Successful exploitation would grant the attacker complete control of the compromised device.