Technical impact
An authorization flaw may allow a malicious application to gain root privileges on iOS, iPadOS, and macOS. The vulnerability stems from improper state management that fails to enforce correct privilege boundaries, described as a type of privilege escalation weakness. If an attacker can run or influence a vulnerable app, they can obtain full system control, enabling the installation of malware, the modification of sensitive data, and a compromise of overall system integrity.
Affected Systems
Apple iOS versions 18.7.9 and 26.5, iPadOS versions 18.7.9 and 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5 are affected. The issue is resolved in each of the stated releases and newer ones.
Risk and Exploitability
The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score is below 1%, suggesting a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector appears to be the execution of a malicious or compromised application that exploits the flawed state handling to elevate privileges, though this inference is drawn from the description and is not explicitly detailed in the CVE data.
