The vulnerability arises from an inconsistent user interface that allowed improper state management, enabling an attacker to forge the Caller ID shown during FaceTime communications. This flaw falls under CWE-451. An attacker who can masquerade as a trusted user may trick recipients into disclosing sensitive information or performing actions under the false pretense of another user.

All recent releases of Apple's multitouch platforms are affected. The issue is fixed starting with iOS 18.7.3 and 26.2, iPadOS 18.7.3 and 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, and watchOS 26.2. Devices running earlier versions remain vulnerable.

The CVSS score of 9.8 marks the vulnerability as critical, and the EPSS score of <1% suggests that exploitation attempts have been rare. The flaw has not yet been listed in CISA's KEV catalog. Because the attacker can masquerade as a legitimate participant in a FaceTime conversation using a forged Caller ID, the attack vector is most plausibly a remote impersonation that can affect any user receiving a call or message. No special privileges are required on the vulnerable device, so the flaw is exploitable remotely by simply initiating or receiving a FaceTime session.