Apple operating systems suffered from a logging flaw that caused sensitive user data to be recorded in system logs without adequate redaction. The flaw can allow an application with sufficient privileges to read such logs and retrieve private information, leading to confidentiality loss for the affected user. The weakness is categorized as Missing Access Control, which can be exploited when the application controls or reads logging data.

Affected products include Apple’s iOS and iPadOS platforms and macOS. The issue has been corrected in iOS 18.4, iPadOS 18.4, and macOS Sequoia 15.4, so any installations of earlier releases are vulnerable.

The CVSS score of 5.5 classifies this as moderate. EPSS indicates a very low likelihood of exploitation, but the vulnerability is still actionable because the information it exposes can be valuable. The flaw is not currently listed in the CISA KEV catalog. Attackers would need to install a malicious or compromised application that can read system logs, or gain elevated privileges, to exploit this issue. No publicly disclosed exploits are known at this time.