CVE-2024-23223 is a privacy issue affecting Apple iOS and iPadOS where an application could access sensitive user data improperly due to inadequate file handling. Apple fixed this vulnerability by improving the handling of files in iOS 17.3 and iPadOS 17.3. The vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource) and has a CVSS v3.1 base score of 6.2 with attack vector local, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. The vendor advisory confirms the fix is included in the mentioned OS versions.

An app running on affected versions of iOS or iPadOS prior to 17.3 may be able to access sensitive user data without proper authorization, potentially leading to privacy breaches. The confidentiality impact is high, but there is no indication of integrity or availability impact. No known exploits have been reported in the wild.

Apple has released official fixes for this vulnerability in iOS 17.3 and iPadOS 17.3. Users and administrators should update affected devices to these versions or later to remediate the issue. Since this is a local vulnerability requiring no privileges or user interaction, patching is the primary and recommended mitigation. No additional vendor-recommended mitigations are noted.