This vulnerability (CVE-2024-40864) involves the potential for an attacker with privileged network access to track user activity on Apple iOS and iPadOS devices. The root cause relates to protocol handling deficiencies that could leak user activity information. Apple fixed the issue in iOS 18.2 and iPadOS 18.2, as well as corresponding updates for macOS, tvOS, and watchOS. The CVSS 3.1 base score is 2.7, reflecting low impact with limited confidentiality loss and no impact on integrity or availability. No public exploits have been observed.

An attacker positioned on the network with elevated privileges could track user activity, resulting in limited confidentiality impact. There is no impact on data integrity or system availability. The vulnerability does not require user interaction and has low complexity to exploit but is limited by the need for privileged network access.

Apple has released official fixes for this vulnerability in iOS 18.2 and iPadOS 18.2. Users and administrators should update affected devices to these versions or later to remediate the issue. No additional mitigation actions are indicated by the vendor advisory.