A privacy flaw allows any application that can read system logs to obtain a contact’s phone number. The issue is a failure in the redaction of private data within log entries, causing personal identifying information to be exposed. The vulnerability is classified as CWE‑532, reflecting the improper handling of sensitive data in logs.

The flaw occurs on Apple’s operating systems, impacting iOS, iPadOS, and macOS. It is resolved in iOS 18.3, iPadOS 18.3, and macOS Sequoia 15.3. Devices running earlier releases remain vulnerable, and applications installed on these systems could read the compromised logs and retrieve phone numbers.

The CVSS score of 3.3 indicates a low severity, and the EPSS score (< 1 %) suggests that exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to run a malicious or compromised application on the device, as log access is typically allowed to applications with appropriate privacy entitlements. Once a log is read, the attacker can extract phone numbers from the log content.