An application can read kernel memory due to an issue with how the operating system manages memory. The flaw allows an attacker to retrieve sensitive data stored in kernel space, which can lead to further compromise if the attacker obtains privileged information or extends the attack surface. The weakness matches CWE-200, which is about information exposure.

All Apple macOS installations are potentially vulnerable; the vulnerability is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.6 and macOS Ventura 13.7.6, so any earlier releases of these macOS versions remain affected.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, meaning the attacker must run code on the target device to trigger the memory disclosure. Because no public exploitation exists, the immediate risk is limited, but the flaw still permits the compromise of confidential kernel data.