The vulnerability is a permissions flaw that allows an application to identify or fingerprint a user across Apple operating systems. Because the system did not enforce sufficient restrictions on the data an app could access, a malicious app could gather identifying information that permits ongoing tracking or profiling of the user. The impact is primarily a privacy violation rather than direct system compromise, but the ability to uniquely identify a device or its user is a significant concern in sensitive environments.

All recent Apple operating systems are affected, including iOS, iPadOS, macOS (Tahoe), tvOS, visionOS, and watchOS. Apple addressed the issue in the 26.6 releases of each platform; devices running versions older than 26.6 remain vulnerable.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1 % reflects a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale attacks. Based on the description, an application could read identifying data that should be restricted; however, the CVE does not specify whether elevated privileges or background execution are required, so these conditions are inferred as possible but not confirmed.