This vulnerability involves a system binary in Apple iOS and iPadOS that could be used to fingerprint a user's Apple Account, potentially enabling user identification or tracking. The issue was mitigated by Apple removing specific flags from the binary, thereby preventing this fingerprinting capability. The vulnerability affects versions prior to iOS 18.2 and iPadOS 18.2. It has a CVSS 3.1 base score of 9.1, indicating a critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity. The vulnerability is tracked as CWE-863 (Incorrect Authorization). No known exploits are reported in the wild at this time.

An attacker can remotely exploit this vulnerability without any privileges or user interaction to fingerprint a user's Apple Account. This could lead to privacy violations through user tracking or identification. There is no reported impact on system availability. The vulnerability affects confidentiality and integrity of user account information.

Apple has released official fixes in iOS 18.2, iPadOS 18.2, and watchOS 11.2 that remove the relevant flags enabling this fingerprinting. Users and administrators should update affected devices to these versions or later to remediate the vulnerability. Patch status is confirmed as fixed by the vendor advisory. No additional mitigation steps are indicated.