A logic flaw in iOS and iPadOS causes identifying information to be leaked to Live Caller ID app extensions when those extensions are disabled. The vulnerability stems from insufficient access control checks, allowing the extensions to access data they should not when the app’s extension is turned off. This results in unintended disclosure of user identifiers.

Clients affected include Apple iOS and iPadOS devices running any version prior to iOS 26.3 and iPadOS 26.3. The issue specifically impacts users who have turned off Live Caller ID app extensions.

The CVSS score of 5.5 indicates moderate severity, while the extremely low EPSS (<1%) suggests limited current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is local to the device; an attacker would need physical or temporary control over the device or access to the user‑controlled Live Caller ID extensions. No remote exploitation vectors are described in the official data.