An Apple team disclosed that insufficient redaction of sensitive information in several operating systems can allow an application to fingerprint a user. The flaw does not enable code execution or privilege escalation, but it permits an app to collect unique device or user characteristics that could be used for profiling or targeted attacks. This potential for data leakage is captured by CWE‑922, which concerns improper handling of information that may reveal sensitive data.

The issue affects Apple devices running iOS, iPadOS, macOS, visionOS, and watchOS. The specific impacted releases are iOS 18.3, iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, visionOS 2.3, and watchOS 11.3. Devices with earlier releases or pending firmware are potentially vulnerable until they receive the stated updates.

The CVSS score of 5.5 indicates a medium severity vulnerability. The EPSS score of less than 1 % signals that the likelihood of exploitation is currently low, and the vulnerability is not listed in CISA’s KEV catalog. Although no direct exploitation method is provided in the advisory, the most probable attack vector involves any application running on the device that has access to the improperly redacted data, allowing it to construct a fingerprint of the user.