This vulnerability involves a timing side-channel attack vector in the cryptographic implementation of legacy RSA PKCS#1 v1.5 decryption on Apple platforms including iOS and iPadOS. An attacker may exploit timing variations during cryptographic operations to decrypt ciphertexts without access to the private key. Apple fixed the issue by enhancing constant-time computation in cryptographic functions, thereby mitigating the timing side-channel. The patch is available in iOS 16.7.6, iPadOS 16.7.6, iOS 17.3, iPadOS 17.3, and equivalent versions of macOS, tvOS, and watchOS.

Successful exploitation could allow an attacker to decrypt RSA PKCS#1 v1.5 encrypted data without the private key, compromising the confidentiality of encrypted communications or stored data relying on this legacy cryptographic scheme. The vulnerability does not affect integrity or availability and requires network attack vector with high attack complexity and no privileges or user interaction. No known exploits have been reported in the wild.

Apple has released official fixes for this vulnerability in iOS 16.7.6, iPadOS 16.7.6, iOS 17.3, iPadOS 17.3, and corresponding updates for macOS, tvOS, and watchOS. Users and administrators should apply these updates promptly to mitigate the risk. Since this is a client-side cryptographic vulnerability, updating the affected Apple operating systems is the recommended and effective mitigation. Patch status is confirmed by the vendor advisory.