The vulnerability arises from insufficient redaction of sensitive data in macOS, enabling an application to read information that should remain private. This flaw aligns with CWE‑922, describing information exposure through improper output handling. An exploited application could retrieve user‑specific sensitive data, thereby compromising confidentiality without granting direct code execution or system takeover.

Apple’s macOS is affected, with the issue present in all versions before Sequoia 15.3. The fix is supplied in macOS Sequoia 15.3 and later, so any earlier Sequoia release or older macOS tier remains at risk.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% signals a low chance of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring a malicious or compromised application with sufficient local privileges to read the exposed information. No remote exploit path is described in the provided data.