An inconsistent user interface state management can allow an application to access sensitive user data, exposing personal information to an attacker. The vulnerability is a classic case of data exposure that could lead to privacy violations and potential misuse of personal data. This weakness aligns with CWE‑200, which highlights improper protection of data from unauthorized disclosure.

The vulnerability affects Apple iOS and iPadOS devices running versions prior to iOS 18.7.3, iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2. Any device using those firmware releases is potentially vulnerable.

The exploit requires a vulnerable operating system version and an application that triggers the inconsistent UI state. Based on the description, it is inferred that the attack vector involves such an application; the vulnerability is not exploitable via external network inputs. Although no EPSS score is available and the issue is not listed in the CISA KEV catalog, the potential for unauthorized data exposure renders this issue medium‑to‑high risk. Attackers can likely trigger the vulnerability through normal app use, meaning the risk is non‑negligible even without a publicly known exploit.