An inconsistency in the user interface allowed an attacker with physical access to a locked device to view sensitive information that should have been protected by the operating system’s lock state. The flaw arises from insufficient state management, leading to inadvertent disclosure of private data via the interface. The specific weakness is classified as CWE‑1021, involving inadequate UI security controls.

Apple iOS and iPadOS devices are affected. The vulnerability is present in all iOS and iPadOS releases older than iOS 18.7.5, iOS 26.3, iPadOS 18.7.5, and iPadOS 26.3. No other versions are listed as affected and no vendor software outside iOS or iPadOS is mentioned.

The CVSS score of 4.6 indicates a moderate risk level, while the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not included in the CISA KEV catalog, implying no known widespread exploitation. The typical attack requires the attacker to obtain physical access to a locked device, after which the UI anomaly can be leveraged to display or copy sensitive data. Because no network vector is involved, the exploitation is confined to situations where a device is left unattended or in possession of a legitimate user without proper lock enforcement.