An authorization flaw in the operating system’s state management allows an application to read user-sensitive data that it should not see. The vulnerability is identified as CWE‑285, indicating improper authorization controls that can be abused to gain access to protected resources. The flaw could let a malicious or compromised app bypass normal permission checks and retrieve data such as contacts, messages, or system settings without the user’s consent.

Apple operating systems are affected: iOS 26, iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, and watchOS 26. Any device running these or earlier, unpatched versions of those platforms is at risk if a malicious app is installed.

The CVSS score of 9.8 marks this as a critical vulnerability with high impact. The EPSS score of less than 1 % indicates a very low probability of exploitation in the wild at the time of this analysis, and it is not listed in the CISA KEV catalog. Likely exploitation requires a malicious or compromised application installed on the device, as the flaw is accessed through local app privileges rather than a network-facing vector. Nevertheless, because the vulnerability grants access to sensitive data, patching is strongly recommended.