The vulnerability is an authorization flaw that was mitigated by improving state management. An application may obtain access to user-sensitive data, enabling it to read or manipulate information it should not be able to. This weakness corresponds to CWE‑284, describing improper access control. The impact is the potential exposure of personal data, but it does not allow arbitrary code execution or system takeover, and the CVSS score reflects a moderate severity.

Affected Apple products include iOS devices running iOS 18.4 or earlier, iPadOS devices running iPadOS 18.4 or iPadOS 17.7.6 or earlier, and macOS installations running macOS Sequoia 15.4, macOS Sonoma 14.7.5, or macOS Ventura 13.7.5 or earlier. Devices on earlier releases are vulnerable.

The CVSS score of 5.5 indicates moderate risk. The EPSS score of less than 1% suggests that exploitation is unlikely, and there is no indication the vulnerability appears in CISA KEV catalog. The attack vector is not explicitly stated; based on the description it is inferred that the issue requires local device access or an existing app that can exploit the state‑management flaw to read privileged data. No public exploits are known and the vulnerability is unlikely to be widely abused.