A flaw that allows an attacker with physical access to a locked Apple device to view sensitive user information. The weakness is a broken access control, identified as CWE-284, which permits unauthorized data access when the device is physically compromised but still locked.

Apple devices running iOS, iPadOS, visionOS, or watchOS are impacted. The issue is fixed in version 26.4 for all four operating systems. Devices on earlier releases, such as any versions before 26.4, remain vulnerable if not updated.

The vulnerability carries a CVSS score of 4.6, indicating moderate severity, and an EPSS score of less than 1%, suggesting a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector requires physical possession of the device; remote exploitation is not possible as the device must be locked. Because the attacker must have the device in hand, the risk to a broader network is limited, but any user who leaves a device unattended could expose personal data.