The vulnerability results from the removal of a previously protected code path, enabling an attacker on the local network to extract sensitive user data. This flaw leads to an unauthorized disclosure of confidential information, as classified by CWE-200. The CVSS score of 5.7 indicates a moderate severity of this information‑disclosure vulnerability.

Affected Apple operating systems include iOS 18.3 and earlier, iPadOS 18.3, iPadOS 17.7.5 and earlier, macOS Sequoia 15.3, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, tvOS 18.3, and visionOS 2.3 and earlier. Apple has released fixes in iOS 18.4, iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, and visionOS 2.4. Devices running versions older than these are considered vulnerable.

The EPSS score of less than 1% indicates a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local network environment, meaning the attacker must be physically or logically present on the same network segment. Despite the low likelihood of exploitation, the potential for sensitive data leakage warrants proactive mitigation. The moderate CVSS score reflects a moderate impact should the vulnerability be successfully exploited.