A flaw in the way Apple’s operating systems sanitize log output can allow an application to read sensitive user data. The vulnerability is identified as a CWE‑200 information exposure flaw, meaning it permits the disclosure of data that should remain private. Because the logged information is not properly scrubbed, an attacker could retrieve personal details or credentials that the application processes, potentially compromising confidentiality for affected users.

Apple’s platforms that include iOS 18.4 and later, iPadOS 18.4 and 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, and watchOS 11.4 are all addressed by the fix. Any device running a version of these operating systems prior to the listed updates remains vulnerable.

The CVSS score of 5.5 places this issue in the medium range, and the EPSS score of less than 1% indicates that the probability of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog, implying no known large‑scale active exploitation. However, the attack vector is inferred to involve a malicious or compromised application that triggers the unsanitized logging process, allowing the app to read data that should be hidden. The potential impact is primarily the exposure of user data, with no guarantee of code execution or denial of service.