A vulnerability enabled a malicious application to read sensitive kernel state, potentially exposing internal system data to the application. The weakness is a classic information disclosure flaw described by CWE-200. Because the uncovered data originates from kernel memory, an attacker could gain insights into system configuration or sensitive identifiers that are normally protected from user space.

Apple’s iOS 18.3, iPadOS 18.3 and 17.7.7, macOS Sequoia 15.3, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.3, visionOS 2.3, and watchOS 11.3 are all impacted. Versions prior to those releases contain the exposed code that allowed the kernel state leak.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. The attack vector is inferred to be local or application‑based, as the vulnerability is triggered by an app that can read privileged kernel data. No public exploit is documented, but the presence of the flaw and the ease of creating a malicious app mean that the risk remains non‑negligible for systems that cannot be updated promptly.