The vulnerability is an authorization flaw that allows a remote attacker to join an iMessage group chat and receive its messages. This improper access control defect can expose private or business communications to an attacker who does not need local privileges. The defect permits reading of group content, compromising confidentiality of the conversation participants.

Apple iOS, iPadOS, macOS, visionOS, and watchOS devices. The issue is fixed in iOS 26.7.3, iOS 27.2.1, iPadOS 26.7.3, iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, and watchOS 27.2.1.

EPSS information is not available and the vulnerability is not listed in CISA's KEV catalog, so the exact exploitation probability is unknown. However, the flaw can be triggered remotely through the iMessage service, meaning any device running an affected OS could be targeted. The lack of a known public exploit does not reduce the risk; the fix is immediately available and should be applied promptly.