A privacy flaw in macOS prevents proper redaction of personal data when log entries are generated. As a result, an application can inadvertently read contact information from system logs, exposing sensitive user data. The weakness is fundamentally an access control issue, aligning with CWE‑284, and could allow a malicious or poorly coded app to retrieve addresses, phone numbers, and other contact details from logs.

All macOS Sequoia releases prior to 15.4 are impacted, as the vulnerability exists until the 15.4 update, which implements the redaction fix. The issue applies to macOS instances where applications have read access to system logs that contain contact data.

The CVSS score of 5.5 indicates moderate severity, and the EPSS figure of less than 1% suggests a low likelihood of exploitation. Based on the description, it is inferred that the attack vector involves a local application accessing system logs. Because the vulnerability appears to depend on an application reading system logs, the most probable attack vector is local or via a compromised app that runs with the user’s privileges. The vulnerability is not listed in the CISA KEV database, meaning no confirmed large‑scale exploits are known at this time.