A permissions issue in Apple’s operating systems allows an application to read a persistent device identifier, a value that uniquely identifies the device. The vulnerability arises from insufficient permission checks, enabling a malicious or poorly designed app to access data it should not have. This disclosure can be used for profiling or tracking the device owner, but does not provide further system compromise.

Apple iOS, iPadOS, tvOS, visionOS, and watchOS before version 26.6 are affected. The issue is fixed in iOS 26.6, iPadOS 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of < 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need the ability to install or run an application that has been granted incorrect permissions; once this application is present, it can read the persistent identifier, allowing for user tracking. The risk is therefore confined mainly to confidentiality loss of the identifier rather than full system compromise.