The vulnerability is an authorization flaw that allows a malicious or compromised application to access sensitive user data that it should not be able to read. It arises from insufficient state management, enabling the app to bypass normal access controls and read data belonging to other apps or the operating system. The impact is the potential disclosure of private information stored on the device.

Apple iOS and iPadOS devices running versions prior to iOS 27 and iPadOS 27 are affected. The issue is mitigated in iOS 27 and iPadOS 27 and later releases.

The EPSS score is less than 1% and the CVSS score is 5.5; the vulnerability is not listed in CISA KEV. The flaw permits unauthorized data read, so exploitation risk remains real. The likely attack vector involves a user installing or interacting with a malicious app that leverages the flaw to read protected data. An attacker would need the ability to execute code on the device, typically through a compromised or malicious application, but no external network conditions are required.