This vulnerability stems from a privacy issue that was resolved by removing sensitive data. In versions prior to iOS 26.3 and iPadOS 26.3, an attacker who gains physical access to a device that is still locked can read private user information that should have been protected. The weakness allows disclosure of confidential data, as classified under CWE‑200, without needing to bypass authentication or compromise the operating system.

The problem affects Apple iOS and iPadOS devices. Anyone using a version older than 26.3 of iOS or iPadOS is susceptible. The known affected CPEs confirm that all models running the operating system prior to the patch are impacted.

The CVSS base score of 4.6 indicates moderate risk, and the very low EPSS (<1%) suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Attacks require physical possession of the device and require it to be locked; no remote exploit exists. In such a scenario, a local attacker could view the leaked data before unlocking the device.