An improper state management flaw in macOS allows a malicious application to read sensitive user information that it should not be able to access. The weakness can expose personal data or credentials stored by the operating system, compromising the confidentiality of a user’s private data. The primary consequence is a breach of privacy and potential exposure of personal or organizational secrets.

Apple’s macOS is affected; the vulnerability is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3. Consequently, all earlier releases—Sequoia 15.0‑15.2, Sonoma 14.0‑14.7.2, and Ventura 13.0‑13.7.2—remain vulnerable.

The CVSS score of 5.5 indicates a moderate risk, and the EPSS score of less than 1 % suggests very low current exploitation likelihood. The flaw is not listed in the CISA KEV catalog, implying no known active exploitation. Based on the description, the attack vector appears local, requiring a malicious application already present or installed on the affected macOS system to exploit the state-management weakness. Precise conditions for exploitation are not detailed, but the vulnerability entails a local privilege escalation capable of leaking confidential data.