The vulnerability is an authorization issue that allows any installed application to initiate telephone calls or send messages beyond what the user intended. This flaw can be exploited by malicious apps to perform unwanted communications, potentially leading to privacy violations, financial loss, or social engineering. The flaw is rooted in improper authorization checks within the OS's networking layer.

Affected devices run Apple iOS or iPadOS older than version 27. The flaw was corrected in iOS 27 and iPadOS 27. Users of earlier releases are at risk if an application abuses this flaw.

The CVSS score of 7.5 indicates a high severity vulnerability, and the EPSS score of <1% suggests a very low but not zero likelihood of exploitation. It is not listed in the CISA KEV catalog, implying no known exploits have been documented. Based on the description, it is inferred that the flaw can be triggered from a non‑privileged app on the device. Attackers could embed malicious code in a legitimate app to initiate calls or send messages without user consent, making this an abuse of the OS authorization controls.