An input validation flaw in Apple iOS and iPadOS allows a user with physical access to a device to view photos from the lock screen, resulting in unauthorized disclosure of personal media. The vulnerability was formally addressed by Apple in iOS 26.3 and iPadOS 26.3, ensuring that the exposed data no longer appears on the lock screen before authentication.

The flaw affects devices running any iOS or iPadOS version prior to 26.3. Apple confirmed the issue in its support article and published a firmware update that eliminates the photo preview from the lock screen.

With a CVSS score of 2.4 the vulnerability is considered low severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. An attacker must have physical access and use the locked device; no network or remote code execution is required. Given the low exploitation probability and limited impact, the risk remains low but mitigable by patching or disabling the preview.