Technical impact
The flaw arises from improper state management in Apple operating systems, causing the device’s IP address to become exposed to an attacker. This exposure enables passive monitoring of the user’s activity or location without granting direct control over the device. The weakness is classified as CWE-359, an information exposure vulnerability that leads to unintended disclosure of sensitive data during transmission.
Affected Systems
Apple iOS, iPadOS, macOS, and visionOS versions existing before 18.7.9, 26.5, 15.7.7, 14.8.7, 26.5, and 26.5 respectively are affected; the listed newer releases contain the fix.
Risk and Exploitability
The CVSS score is 7.5 and the EPSS score is less than 1%; the flaw is not included in the CISA KEV catalog. The likely attack vector is passive observation of network traffic or the device’s state changes, inferred from the description that an attacker may track users by IP address. Exploitation does not appear to require privileged access or active interaction, so the practical likelihood remains low to moderate, but the persistent risk of privacy compromise warrants timely patching.
