An authorization flaw was found in certain iOS and iPadOS releases where the operating system did not correctly enforce state management for locked devices. The weakness could allow an attacker who physically possesses the device when it is locked to bypass expected authorization checks and view confidential data stored on the device. This vulnerability maps to CWE‑285, reflecting an authorization bypass that exploits mismanagement of state information.

Apple iOS and iPadOS devices running firmware versions prior to the fixes are at risk. The security advisory confirms that iOS and iPadOS iterations earlier than 18.7.5 and 26.3 contain the unpatched flaw. Devices running these older releases, regardless of model, are potentially affected.

The CVSS base score of 4.6 indicates moderate severity; the EPSS score is under 1 %, implying a very low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Attack vectors are limited to physical access of a locked device; remote exploitation is not feasible according to the advisory. An attacker, therefore, must physically obtain the device, keep it locked, and then use the flaw to read protected information.