The vulnerability arises from an inadequate restriction of data container access, enabling an application to read data that should be isolated from other apps. Affected applications could read sensitive user information such as passwords, personal files, or secrets that reside in protected containers. This flaw is a confidentiality breach (CWE‑200). The high CVSS score of 9.8 reflects that the bug permits full disclosure of protected data without authentication requirements.

The issue impacts Apple platforms that are not running the patched releases: iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, tvOS 18.4, and watchOS 11.4. Devices with earlier OS versions may allow any installed app to access confidential data in the container directories.

With an EPSS score of less than 1 % the probability of exploitation is currently low, and the vulnerability is not listed in CISA KEV. Nevertheless, the critical CVSS score indicates that a successful exploitation would compromise confidentiality of user data. The likely attack vector is an application that is installed on the device—malicious or misconfigured—that gains read access to protected container data. Remediation requires vendors to deploy the corrected sandbox restrictions.