The vulnerability is an authorization issue that allows an attacker with physical access to a locked Apple device to view sensitive user information. The flaw results from improper state management and represents a breach of confidentiality, consistent with CWE‑287. This means an adversary can read personal data on the device without authenticating normally.

All iPhones and iPads running iOS and iPadOS prior to the fixes in iOS 18.7.5, iPadOS 18.7.5, iOS 26.3, and iPadOS 26.3 are subject to this flaw. Newer releases after these patches incorporate the corrected state management and are not affected.

The CVSS score of 5.5 indicates moderate severity, while an EPSS score of less than 1% reflects a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, and no public exploits are known. The likely attack vector requires physical possession of a locked device, limiting the feasibility of remote attacks but making the confidentiality impact significant for physically compromised devices.