This vulnerability involves a path handling flaw in Apple iOS and iPadOS that could enable an app to escape its sandbox environment, potentially leading to unauthorized access or actions beyond its intended scope. Apple fixed this issue by improving validation of path handling in iOS 18.4, iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, and watchOS 11.4. The CVSS 3.1 vector indicates the attack requires local access with low complexity and low privileges, no user interaction, and impacts confidentiality, integrity, and availability with low to medium impact.

An app exploiting this vulnerability could break out of its sandbox, potentially gaining unauthorized access to system resources or data beyond its permitted boundaries. This could lead to partial compromise of confidentiality, integrity, and availability of the affected device. However, exploitation requires local access and low privileges, limiting the attack surface.

A fix is available and has been released by Apple in iOS 18.4, iPadOS 18.4, iPadOS 17.7.6, and other related OS versions. Users and administrators should update affected devices to these versions or later to remediate this vulnerability. There is no indication of known exploits in the wild at this time.