An authorization flaw in Apple iOS and iPadOS stems from improper state management. This vulnerability permits an application to read or manipulate sensitive user data that it should not be able to access, exposing personal or confidential information. The impact is the potential loss of data confidentiality and privacy, without requiring elevated privileges beyond using a malicious or compromised application.

Apple iOS and iPadOS devices running any version earlier than 26.6 are impacted. The issue is fixed in iOS 26.6 and iPadOS 26.6 and does not affect later releases.

The EPSS score is < 1%, indicating a very low but non-zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 reflects moderate severity. An attacker does not need special privileges beyond installing or running a malicious app, a likely attack vector inferred from the description. The flaw operates locally on the device, so any user who runs a malicious application could potentially exploit it. The moderate CVSS score combined with the low EPSS suggests that while exploitation is technically feasible, it is not widely observed at present.