This vulnerability involves a path handling flaw in Apple iOS and iPadOS that allowed an attacker who already has access to calendar data to also read reminders, potentially exposing additional user information. The issue is tracked as CVE-2024-54535 and is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). It has a CVSS 3.1 base score of 4.0, indicating medium severity, with an attack vector limited to local access (AV:L), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). The vulnerability was fixed in iOS 18.1 and iPadOS 18.1 through improved path handling logic.

An attacker with existing access to calendar data could leverage this vulnerability to also read reminders, potentially exposing additional sensitive user information. The confidentiality impact is limited to information disclosure (low impact), with no impact on integrity or availability. There are no known exploits in the wild, and the attack requires local access to calendar data.

This vulnerability is fixed in iOS 18.1 and iPadOS 18.1. Users and administrators should update affected devices to these versions or later to remediate the issue. Since this is not a cloud service, patching the device OS is required. No additional mitigation steps are indicated by the vendor advisory.